Ransomware Threats Surge in Healthcare as Vulnerabilities Exploited

A recent report by Sophos, titled “State of Ransomware in Healthcare 2025,” reveals that exploited vulnerabilities have become the primary technical cause of ransomware attacks in the healthcare sector. The study, which analyzed data from 292 healthcare providers, shows a significant shift in the way ransomware operates, highlighting increased extortion-only attacks and mounting pressure on IT teams.

Vulnerabilities and Capacity Gaps Drive Attacks

For the first time in three years, the report indicates that exploited vulnerabilities accounted for 33% of all ransomware incidents. This marks a notable shift in the underlying causes of attacks. On the organizational side, a lack of personnel and cybersecurity expertise was identified as the leading factor by 42% of organizations that experienced breaches. Close behind, 41% of victims cited known security gaps as a contributing factor, emphasizing the critical need for better resource allocation and risk management within healthcare systems.

Shifts in Attack Dynamics

Despite improvements in defenses against data encryption, adversaries are increasingly targeting the sensitivity of medical information. The rate of data encryption during attacks has fallen to its lowest level in five years, with only 34% of incidents resulting in encryption. This is a significant decrease from a peak of 74% in 2024. In contrast, the proportion of healthcare organizations experiencing extortion-only attacks—where data was stolen but not encrypted—has tripled, now accounting for 12% of all attacks in 2025.

The economic landscape for ransomware attacks in healthcare has also shifted dramatically. The average ransom demand has plummeted by 91% over the past year, decreasing from $4 million in 2024 to just $343,000 in 2025. Similarly, the median ransom paid by organizations fell from $1.47 million to $150,000, marking the lowest figure recorded across all industries surveyed. Recovery costs, excluding ransom, have decreased by 60%, averaging $1.02 million compared to $2.57 million in 2024.

The report highlights the human impact of these incidents, particularly on IT and cybersecurity teams. Among those who experienced data encryption, 39% reported increased pressure from senior leadership, while 37% noted heightened anxiety regarding future breaches. Fortunately, recovery times have improved, with 58% of healthcare providers managing to recover within a week in 2025, a significant increase from only 21% in 2024.

Despite this progress, the reliance on data backups has declined. The use of backups to restore encrypted data has fallen to 51%, down from 72% in 2022. This decline could indicate potential weaknesses in backup systems or diminished confidence in their effectiveness.

The findings of the Sophos report underscore the evolving nature of ransomware threats in healthcare, highlighting the need for organizations to bolster their cybersecurity measures and ensure adequate staffing to address vulnerabilities effectively. As the sector grapples with these challenges, it is clear that ongoing vigilance will be essential to safeguard sensitive medical data from increasingly sophisticated cybercriminals.