Article
The numbers
Health-ISAC’s fourth-quarter 2025 report, released Jan. 30, counted 575 cyberattacks aimed specifically at the health sector in 2025, up from 476 in 2024, a 21% increase. That was slower growth than in other industries: breaches across all sectors rose 55%, to 8,903. The number of patient records breached fell in 2025, but that comparison is skewed by 2024’s Change Healthcare attack, which affected 192.7 million people.
Health-ISAC sent 183 targeted alerts to member organizations in the fourth quarter. Recurring risks included exposed remote access tools, open databases and unpatched vulnerabilities in widely used endpoint management and Windows update software.
A separate Trellix report published in late January, based on 54.7 million detections in health care environments, found that email accounted for 85% of detections and phishing provided initial access in 89% of incidents. Extortion-only attacks, where criminals steal data without encrypting systems, made up 12% of attacks on health care organizations in 2025, a 300% increase from 2023. Trellix called the cascading effect, where one organization’s outage disrupts others, the defining trend of the year.
The insider and vendor angle
On Feb. 3, a federal grand jury added two counts of making false statements to the case against a former Nuance Communications employee accused of downloading data on 1.3 million Geisinger patients to a personal laptop in 2023. Geisinger and Nuance have agreed to a $5 million class-action settlement. The case is a useful example for boards because the alleged breach came through a vendor’s employee, not a hospital system or a ransomware gang.
Questions boards should be asking
- Vendor access. How many third parties can reach patient data, and when was each one’s access last reviewed and reduced to what it needs?
- Exposed services. Are remote access tools and databases scanned regularly from the outside, the way attackers see them?
- Email defenses. Given phishing’s role, what is the trend in phishing test failures, and is multifactor authentication enforced everywhere, including for vendors?
- Extortion readiness. Backups do not help when data is stolen rather than locked. Is there a playbook for data-theft extortion, including legal, regulatory and patient communication steps?
- Cascading outages. If a key clearinghouse, lab or EHR host goes down, how long can clinical and revenue operations continue?
Cybersecurity spending competes with every other priority in a tight budget year. These questions help direct it toward the threats the data actually shows.
Archive entry for Feb 8, 2026, added Nov. 11, 2026.