Ransomware has emerged as one of the most persistent and costly cybersecurity threats to critical infrastructure in the United States – and the healthcare sector sits squarely in its crosshairs. 

According to the FBI’s 2024 Internet Crime Report, the healthcare industry suffered over 440 ransomware attacks and data breaches, more than any other critical sector. Experts attribute this trend to the industry’s heavy reliance on real-time access to patient data, legacy IT systems, and underfunded cybersecurity operations. 

Threat actors have been known to follow new trends, using tactics like social engineering to trick employees into granting access, malicious software posing as legitimate tools, exploiting unpatched software vulnerabilities, credential theft to move laterally within networks, and exfiltrating data before encryption to double the leverage in ransom demands. 

The rise of Ransomware-as-a-Service (RaaS) models has also lowered the barrier for entry, allowing even low-skill actors to rent ransomware toolkits from more advanced developers. 

These attacks are no longer just digital nuisances – they are disrupting medical care, risking patient safety, and costing institutions millions in recovery and lost revenue. In many cases, ransomware gangs now steal sensitive data and threaten to leak it publicly if ransoms aren’t paid – a tactic known as double extortion. 

The most recent victim is Kettering Health, a major Ohio-based medical network. On Tuesday May 13, a ransomware attack by the group known as Interlock brought Kettering’s operations to a halt. The attack triggered a system-wide outage across 14 hospitals, forcing staff to cancel elective procedures and revert to pen-and-paper documentation. 

The attackers left a ransom note: “Your network was compromised, and we have secured your most vital files.” The stolen data included payroll records, employee files, scanned IDs, police security documents, Medicaid applications, pharmacy and blood bank data, corporate financials, and patient medical records. 

Though the specific entry point remains unclear, Interlock is known to exploit social engineering, malicious software posing as legitimate programs, and unpatched system vulnerabilities. After breaching the perimeter, they often steal credentials to move laterally and exfiltrate data before encrypting systems and demanding payment. 

This type of disruption is not isolated. Similar incidents affected Ascension Health and a UnitedHealth subsidiary in 2024, sparking congressional attention and calling for stronger hospital cybersecurity policies. Despite the warnings, many healthcare systems remain underprepared, lacking both modern defenses and incident response strategies. 

Kettering Health managed to restore its electronic health record (EHR) system on June 2, 2025, nearly three weeks after the attack. Still, the damage to operations, patient trust, and internal morale may last far longer. 

To guard against future attacks, healthcare organizations must prioritize adding security controls to their network, including endpoint detection and response (EDR), network segmentation, vulnerability management, and active monitoring of data access patterns. 

Human controls are also just as pertinent. Implementing measures such as regular employee phishing simulations, mandatory cybersecurity awareness training, and strict access management policies help safeguard against trends targeted towards humans listed above. 

While no system can be perfectly secure, especially against unpredictable human behavior, the combination of proactive defense strategies and clear incident response plans can significantly reduce the fallout when attacks occur. 

BACK TO BLOGS