Health-ISAC Warns U.S. Healthcare Sector of DDoS Threats Amid Iran Tensions The Health Information Sharing and Analysis Center (Health-ISAC) has issued a warning to U.S. healthcare organizations, urging them to strengthen their cybersecurity defenses against potential distributed denial-of-service (DDoS) attacks linked to escalating military tensions with Iran. While no specific, credible threats have been identified, the sector remains at risk from hacktivist groups sympathetic to Iran, rather than direct nation-state attacks. Health-ISAC Chief Security Officer Errol Weiss emphasized that historical patterns show an increase in DDoS activity and hacktivist operations during geopolitical conflicts. Public-facing systems including clinical websites, patient portals, VPNs, and internet-exposed IoT devices are particularly vulnerable. A recent incident in Israel saw a hospital’s IoT system compromised by pro-Iranian hacktivists, underscoring the threat. To mitigate risks, Health-ISAC recommends three key actions: 1. Enhancing DDoS protections by working with ISPs, CDNs, and cloud providers. 2. Hardening internet-facing systems, particularly VPNs and remote access points, with a focus on identity security to prevent credential-based attacks. 3. Rehearsing downtime and incident-response procedures to ensure continuity of critical clinical services during disruptions. The Cybersecurity and Infrastructure Security Agency (CISA) has also updated its guidance on DDoS defense, while the Health Care Cybersecurity and Resiliency Act a bill proposing grants for hospital cybersecurity improvements advanced in the Senate this week. Security experts, including CloudWave’s Brian Lamberger, note that even short-lived DDoS disruptions can severely impact operations, such as blocking access to electronic health records (EHRs). While pro-Iranian hacktivist claims have surged, evidence of successful, high-impact attacks remains limited. The healthcare sector is advised to remain vigilant without overreacting to unverified threats.

Ransomware Attacks on Healthcare: A Crisis Beyond the Targeted Hospital Ransomware attacks on healthcare organizations are among the most disruptive cyber threats, with consequences extending far beyond the initial victim. Unlike data breaches or malware infections, ransomware directly disrupts patient care by locking critical systems, forcing hospitals to divert ambulances, cancel procedures, and rely on manual processes like pen-and-paper records. The ripple effects overwhelm neighboring facilities, straining resources and delaying treatment for patients sometimes with fatal outcomes. Why Healthcare is a Prime Target Attackers exploit the sector’s vulnerabilities, including legacy systems, underfunded cybersecurity programs, and the high stakes of patient care. Hospitals, particularly large systems, are lucrative targets due to their size and the urgency of restoring operations. Even well-resourced institutions struggle with outdated infrastructure, untrained staff, and supply chain risks, leaving gaps that ransomware groups exploit. Spillover Effects and Systemic Strain When a hospital is hit, surrounding facilities absorb the overflow of patients, leading to overcrowding, staff burnout, and supply shortages. Rural areas face even greater challenges, as delayed ambulance transfers can worsen patient outcomes. A 2025 study linked ransomware incidents to poorer survival rates for cardiac arrest patients at adjacent hospitals, underscoring the broader public health impact. Preparation and Gaps While some hospitals conduct ransomware drills and test backup systems, many lack basic defenses like multifactor authentication (MFA) or patched software. Experts emphasize cyber hygiene regular patching, backup testing, and recovery planning as critical first steps. However, no single solution addresses all risks, given the complexity of healthcare IT environments. The Role of AI and Emerging Threats Artificial intelligence is emerging as a tool to detect anomalies in patient data and automate threat response, but its adoption remains uneven. Meanwhile, ransomware attacks show no signs of slowing: Health-ISAC tracked 446 healthcare incidents in 2024, with 281 already reported in early 2025. The threat landscape continues to evolve, with attackers targeting third-party vendors and exploiting remote access vulnerabilities. The healthcare sector’s resilience is tested by each attack, revealing both progress in preparedness and persistent gaps that leave patients and providers vulnerable.

Health-ISAC, the Health Information Sharing and Analysis Center, is on the front lines of cyber defense for the healthcare industry, engaging healthcare stakeholders worldwide to address mounting cybersecurity threats. With rising instances of ransomware attacks and data breaches, leaders are increasingly focusing on phishing and third-party partner breaches, advocating for intelligence-led security practices over mere compliance. Recent analysis by Health-ISAC's CSO reveals a staggering rate of patient record breaches, highlighting the urgency for better cybersecurity investment in healthcare. The organization suggests financial incentives for improved security rather than penalties, advocating for continued vigilance and innovation to protect patient care providers from evolving cyber threats.