Ransomware Attacks on Healthcare Surge in H1 2026, Reaching New Highs The first half of 2026 saw a sharp rise in ransomware attacks targeting the healthcare sector, averaging 2.3 incidents per day a 14% increase from the second half of 2025. A total of 410 attacks were recorded, with 247 striking hospitals, clinics, and direct care providers, while 163 hit healthcare-related businesses, including pharmaceutical manufacturers, medical billing firms, and tech companies. Attacks on healthcare providers rose by 3%, but those on healthcare businesses surged by 35%, with medical device retailers and drug wholesalers experiencing the steepest increase (67%). Manufacturers saw a 36% rise, while healthcare tech firms faced a 12% uptick. ### Key Findings - Healthcare Providers (247 attacks): - 55 confirmed, 192 unconfirmed - 424,740 records breached in confirmed attacks - Median ransom demand: $310,000 - Top ransomware strains: Qilin (41 claims), The Gentlemen (31), LockBit (17), INC (15) - Healthcare Businesses (163 attacks): - 22 confirmed, 141 unconfirmed - 154,825 records breached in confirmed attacks - Median ransom demand: $300,000 - Top ransomware strains: DragonForce (14), The Gentlemen (13), INC (12), Qilin (10) ### Major Breaches in H1 2026 The largest incidents included: - Unimed (Germany, April 2026) – 135,000 affected (data theft, possible ransom payment) - Nippon Medical School Musashi Kosugi Hospital (Japan, February 2026) – 131,700 affected ($100M ransom demand, unpaid) - Caribbean Medical Center (Puerto Rico, February 2026) – 92,000 affected (claimed by The Gentlemen) - Lakelands Public Health (Canada, January 2026) – 60,000 affected (claimed by Lynx) - Mt. Spokane Pediatrics (U.S., January 2026) – 32,021 affected (claimed by LockBit) Most of these breaches occurred in January–March 2026, highlighting delays in public disclosure. ### Ransom Demands & Payments - Median demands were $310,000 (providers) and $300,000 (businesses). - No official ransom payments were confirmed, though Unimed (Germany) is rumored to have paid. - Nippon Medical School (Japan) rejected a $100M demand, the largest in H1 2026. - TINYpulse (WebMD Health Services, U.S.) faced a $2M demand in June 2026 after 859MB of Nintendo employee data was stolen. ### Geographic Trends - U.S. (225 attacks) – Most targeted, though attacks on providers dropped 7%. - Germany (18), India (17), Canada (15), Australia (12) – Significant increases, with India (+700%) and Canada (+83%) seeing the largest spikes. - Japan, Brazil, Poland, New Zealand, and Colombia also saw notable attacks. ### Dominant Ransomware Groups - Qilin led attacks on providers, with 8 confirmed incidents (4 in the U.S., 2 in Germany). - The Gentlemen targeted six organizations across Brazil, India, New Zealand, Poland, Puerto Rico, and Japan. - DragonForce focused on healthcare businesses, including Kopran Ltd (Japan) and Reha-Activ (Germany). ### Attack Confirmation Challenges - Confirmed attacks require public disclosure or matching ransomware claims. - Unconfirmed attacks (192 providers, 141 businesses) may involve undisclosed breaches or false claims. - U.S. breach disclosure laws contribute to higher confirmation rates compared to other regions. The data underscores a new normal of persistent ransomware threats in healthcare, with attackers increasingly targeting both providers and supporting businesses.

Ransomware Surge in Healthcare: Q1 2026 Attacks Highlight Persistent Threats The first quarter of 2026 saw 201 ransomware attacks targeting the healthcare sector, with 120 directed at hospitals, clinics, and providers, and 81 at related businesses including pharmaceutical manufacturers, medical billing firms, and healthcare tech companies. While attacks on providers declined by 15% compared to the previous quarter, incidents against healthcare businesses rose for the third consecutive quarter, surging 35%. Despite the dip in provider-focused attacks, the sector remains a prime target for cybercriminals due to its lucrative data and operational vulnerabilities. A February 2026 attack on the University of Mississippi Medical Center crippled systems for weeks, forcing clinic closures until March. Other high-profile breaches included Nippon Medical School Musashi Kosugi Hospital in Japan, where NetRunner exposed 131,700 records, and Hospital Caribbean Medical Center in Puerto Rico, where The Gentlemen compromised data for 92,000 individuals. Healthcare businesses also faced significant disruption. UFP Technologies, a medical device manufacturer, reported billing and shipment delays after a Payouts King attack in February, while Healthdaq, an Irish healthcare recruitment firm, disclosed a breach following an XP95 intrusion in March. In India, Glenmark Pharmaceuticals lost 1.8 TB of data to INC, and Kopran Ltd suffered a DragonForce attack with 284 GB stolen. ### Key Findings for Q1 2026 - Healthcare Providers (120 attacks): - 26 confirmed, 94 unconfirmed. - 237,747 records breached in confirmed attacks. - Median ransom demand: $300,000. - Top ransomware strains: Qilin (23 attacks), The Gentlemen (10), LockBit (9), Sinobi (7). - 13 TB of data allegedly stolen, with Beast claiming 2 TB across three attacks. - Healthcare Businesses (81 attacks): - 5 confirmed, 76 unconfirmed. - Top strains: INC (8), NightSpire (8), Genesis (6), Akira (5), LockBit (5). - 29 TB of data allegedly stolen, including Metaencryptor’s unconfirmed 14 TB theft from a German pharmaceutical firm. ### Geographic Breakdown The U.S. bore the brunt of attacks (59%, 119 incidents), followed by India (10), Germany (7), and Australia (6). Among confirmed attacks, the U.S. led with 10, while Germany and Japan each reported three. Reporting disparities due to varying national disclosure laws may skew confirmed attack figures. ### Ransomware Groups’ Tactics Qilin dominated provider attacks (23 incidents), while INC and NightSpire led business-targeted campaigns (8 each). Notably, Qilin’s focus shifted away from businesses, with only three attacks recorded in that subsector. Hackers claimed to have exfiltrated more than twice the data from businesses (29 TB) than providers (13 TB), despite fewer total attacks. The quarter underscored the healthcare sector’s enduring appeal to ransomware operators, driven by high-value data, critical infrastructure, and often inadequate defenses.