Health care is among the most heavily targeted sectors for ransomware, because disruption translates directly into delayed care and exposed patient data. This quarter, health care and social assistance organizations named on data-leak sites rose 70% to 327, and that exposure spread across more operators rather than concentrating under one dominant group.
What stands out is how attackers are getting in. Exploit Public-Facing Application reached 39% of observed techniques, Web Shell climbed to 9%, and credential exposure overtook every other digital risk alert in the sector. Attackers are reaching clinical systems and PHI through exposed applications, stolen credentials, often with no user click at all, and through social engineering that targets staff directly.
Slow defense isn’t an option when access can quickly become patient-care impact.
Four Ways Teams in the Health Care Sector Can Act Now
1. Harden the internet edge against exploitation. Exploit Public-Facing Application was the clearest driver of activity at 39%, and new vulnerabilities seen in active exploitation rose 76% to 109—with 59 weaponized within 5 days of disclosure and same-day exploitation nearly doubling to 32. Attackers moved quickly on internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch VPN and firewall flaws first, disable exposed RDP or put it behind a VPN with MFA, and restrict management-interface exposure. For CVE-2026-76504—a CVSS 10 authentication bypass in Cisco Catalyst SD-WAN Manager, exploited in the wild—upgrade to a fixed release immediately, because compromise of SD-WAN management can disrupt clinics and connected sites. Until then, restrict Manager internet exposure, review admin and API logs, and hunt for unauthorized configuration changes.
2. Detect the behaviors ransomware operators share. Sector exposure spread across “The Gentlemen,” “Inc Ransom,” “Qilin,” “Dire Wolf,” and “Anubis” this period, with new names appearing and several exceeding their all-sector baselines. Tracking individual group names will always lag a roster that turns over every quarter. Tag and prioritize the assets that carry the most clinical risk—electronic health record systems, connected medical devices, privileged service accounts, and patient portals—then detect the techniques these operators have in common, such as abuse of remote-access and data-transfer tools like AnyDesk and rclone. Pair those detections with application control and phishing-resistant MFA to prevent the access and exfiltration in the first place.
3. Shut down credential exposure and identity abuse. Credential exposure surged to become the leading digital risk alert for the sector, and the reporting period’s most active campaigns ran on stolen identity. “Storm-2755” used adversary-in-the-middle phishing to steal session tokens and hijack Microsoft 365 sessions, defeating non-phishing-resistant MFA, while Microsoft Teams vishing callers talked staff into installing persistent backdoors. Monitor the open, deep, and dark web for exposed PHI and credentials, enforce phishing-resistant MFA across payroll and clinical accounts, and automate phishing triage so a reported email is investigated the moment it lands.
4. Contain at machine speed. Sector mean time to contain (MTTC) improved 49% this period, from 2 hours and 7 minutes to 1 hour and 5 minutes. That is real progress, and still far too slow when an exploited edge device or stolen session can reach patient data in minutes. Health care organizations using Automated Response Playbooks contained threats in an average of 8 minutes. Known-malicious behavior—validated command-and-control, confirmed credential abuse, or ransomware tooling—should trigger immediate response through approved playbooks, where the risk of waiting outweighs the risk of acting.
What Agentic Defense Looks Like for Health Care
Health care organizations cannot accept a black box making response decisions across clinical and regulated systems. They need AI that is governed, explainable, and directed by their own team.
GreyMatter is built for that operating model. The platform decomposes investigations into single-task agents across identity, endpoint, network, cloud, and email, and routes each task through the AI Model Broker, which selects the best model for the job by cost, speed, and accuracy—without the customer managing models or usage costs. It normalizes telemetry across a health system’s existing tools with its Universal Translator, running detection at source, at storage, or in transit so threats are caught before data must centralize.
For health care, that means stopping credential-based attacks before they reach patient data—automating phishing triage, containing identity intrusions in under 5 minutes, and monitoring the dark web for exposed PHI continuously. In the most targeted sector for ransomware, speed and accuracy are not aspirational. They are required.
