Article
What the FBI asked for
Speaking to hospital executives at the American Hospital Association meeting in Washington on April 21, FBI Deputy Director Andrew Bailey urged health systems to share more information about cyberthreats with federal law enforcement and to do it sooner. He described a strategy built on disrupting criminal networks, rather than only pursuing arrests after the fact, and said earlier warnings from hospitals help the bureau identify attacks in progress.
Health care was the top target for ransomware and other cyberthreats last year, according to FBI statistics cited by Axios. Bailey pointed to Russian-speaking ransomware-as-a-service groups that operate with safe harbor from the Russian government. Attacks in 2025 hit Yale New Haven Health and DaVita, among others, and such incidents can halt operations, delay care and cost millions of dollars.
Why hospitals hesitate
Many hospitals are cautious about calling law enforcement early. Leaders worry about legal exposure, loss of control over the investigation, disclosure obligations and reputational harm. Some first call outside counsel and an incident response firm and contact the FBI only later, if at all. That delay can mean lost indicators of compromise that might have helped other hospitals or led to disruption of the attackers.
Practical steps for leadership
- Name a contact: Make sure your security leader knows the cyber staff at your local FBI field office before an incident.
- Update the playbook: Add law enforcement notification to your incident response plan, with clear triggers and timing, and review it with counsel.
- Join sharing groups: Participate in sector information-sharing organizations and decide what your team can share routinely.
- Test it: Include the FBI contact step in tabletop exercises with executives and the board.
- Brief the board: Explain how and when the organization will engage law enforcement and what that means for disclosure decisions.
Archive entry for Apr 23, 2026, added Nov. 11, 2026.