Data breaches often result from compromised credentials, vulnerable medical applications, misconfigured cloud services, or unauthorized access. In such cases, medical data and patient information are exposed or exfiltrated, leading to legal consequences, loss of trust, and reputational damage.

Social engineering involves manipulating medical staff, administrative personnel, or partners through phishing, vishing, smishing, or compromised institutional email accounts to obtain access credentials, introduce malware, or redirect payments.

Attackers may impersonate healthcare authorities, medical service providers, national health insurance entities, or executive staff, exploiting internal approval workflows and remote work conditions.

Ransomware and malware are used to encrypt systems, extract data, and disrupt operations. Increasingly, attacks involve “double extortion” mechanisms, combining data theft with system disruption, and in some cases, DDoS attacks.

In many cases, attackers remain within the infrastructure for a period of time before launching the attack, mapping critical systems and backups. Deployment time has significantly decreased, averaging around 24 hours.

Ransomware attacks directly impact clinical systems (HIS, EHR, EMR), where system unavailability immediately affects medical operations and access to essential patient data. Approximately 92% of European cases involve both file encryption and data exfiltration.

Supply chain attacks involve compromising third-party medical applications, IT service providers, or outsourced processes to gain indirect access to hospitals and clinics.

Attackers exploit remote administration tools, software updates, cloud services, or medical data exchange channels to bypass security controls and obtain legitimate access within the network.

Credential theft is commonly carried out through fake notifications impersonating communications from hospitals or national health authorities, aiming to capture login credentials.

Attacks also include QR code redirections to malicious pages and the use of infostealers (e.g., RedLine, Vidar) to automatically collect credentials. There is also a growing trend of compromised healthcare credentials being sold online, including VPN or RDP access to hospital networks.

A cyberattack on AZ Monica Hospital led to IT system outages and limited medical activity.

Over 70 surgeries were canceled, and patients were transferred to other facilities. Access to electronic medical records was unavailable, and recovery took approximately one month. This case highlights the direct impact of system outages on medical operations.

A ransomware attack on Synnovis, a laboratory service provider for NHS hospitals in London, directly impacted diagnostic capacity across multiple medical units.

Over 1,100 procedures were canceled, and laboratory processing capacity dropped significantly. At the same time, approximately 400 GB of medical data was exfiltrated and published, with full system recovery estimated to take over 17 months.

A ransomware attack targeting the HIS Hipocrate platform affected multiple medical institutions in Romania, spreading rapidly due to a lack of segmentation.

Data was encrypted in 26 hospitals, while over 100 units were disconnected as a precaution. In some cases, medical activity temporarily reverted to manual processes. The ransom (~3.5 BTC) was not paid. The incident shows how lack of segmentation enables rapid spread across multiple organizations.

A cyberattack on Change Healthcare affected over 100 million individuals and disrupted critical processes such as billing and pharmaceutical supply chains. Initial access was obtained through compromised credentials, making it the largest breach in healthcare history.

Between 2023 and 2024, several hospitals across Europe, including in Denmark, Germany, and the Netherlands, were targeted by coordinated DDoS attacks linked to pro-Russian groups such as Killnet.

These attacks did not involve system compromise or data exfiltration but affected the availability of digital services, including online platforms used by patients and staff.

Ultimately, cybersecurity becomes effective only when technology, processes, and the human factor work together in an integrated way. Regular training, phishing attack simulations, and risk awareness play a decisive role in reducing the attack surface.

Expertware, in partnership with the National Cybersecurity Directorate (DNSC), regularly organizes webinars focused on risk awareness across various sectors, the most recent one being in the healthcare sector. The presentation can be found here.