Attacks ‘Cascade’ From IT, OT to Patient Care

Of the millions of threats detected in healthcare IT environments last year, email phishing, identity failures and device vulnerabilities were among the dominant vectors for non-clinical IT compromises – often “cascading” into patient care workflows and causing nearly $2 million a day in losses, said a new report from security firm Trellix.

See Also: Ransomware’s Real Damage in 2025 Wasn’t the Ransom

Of 54.7 million threats detected by Trellix last year across its healthcare customers worldwide, 75% originated at U.S.-based organizations, with email incidents – including phishing – accounting for at least 85% of the detections, Trellix said.

The Milpitas, California-based security firm did not respond to Information Security Media Group’s request for the percentage of the company’s healthcare clients that are based in the United States.

“The most pressing weaknesses are email and identity failures, legacy medical and OT systems, and a lack of visibility into lateral movement and data exfiltration,” said Anne An, principal threat intelligence analyst at Trellix.

“These vulnerabilities not only allow attackers to move quietly from administrative access to clinical environments, leading to disruption of care, data theft and patient extortion, but also create a ‘cascading effect’ that directly impacts patient safety and turns cybersecurity incidents into patient safety crises,” she said.

Healthcare organizations responding to ransomware and other cyberattacks often shut down most of their IT systems to prevent compromises or intrusion from spreading to clinical systems – resulting in the inability for clinicians to access patients’ digital records.

Trellix cited that these hospital outages can cost some healthcare organizations an estimated $9,000 per minute and $1.9 million per day, with an average of more than 17 days of downtime per attack.

These incidents also can potentially affect patient outcomes. Trellix notes that a 2024 study by researchers at the University of California San Diego found that ransomware attacks on hospitals can potentially affect the outcomes of cardiac arrest and stroke patients being cared for at nearby hospitals that were not attacked.

Researchers in that study theorized that delayed care for cardiac patients who were diverted away from the attacked hospital, as well as higher patient caseloads overall at the emergency departments of nearby untargeted facilities, may be factors contributing to negative patient outcomes (see: Cyberattack Forces San Diego Hospital to Divert Patients).

Other Trends

In addition to disruptive attacks, incidents involving data theft and extortion also are on the rise, Trellix said.

Adversaries are shifting from pure encryption to “triple extortion,” which includes direct patient harassment, Trellix said. Trellix said “extortion-only” hacks accounted for 12% of healthcare attacks in 2025 – a 300% increase since 2023 – while the average ransom payment fell to $150,000.

Qilin, IncRansom and relative newcomer, DevMan2, a former affiliate group of IncRansom and RansomHub, were among the most active cybercriminal gangs hitting healthcare sector organizations in 2025, Trellix said.

Ransomware monitoring site Ransomware.live as of Monday said DevMan2 had 174 victims as of April 2025.

DevMan 2 “is notorious for massive data exfiltration, with individual healthcare breaches consistently ranging from 200 gigabytes to 300 gigabytes of stolen patient data per incident,” Trellix said.

Patient extortion will become more common and more personal in the months ahead, An said. “‘Quiet’ breaches will increasingly outpace loud ransomware attacks, as adversaries have learned that stealing data without disrupting care reduces detection and increases leverage,” An said.

To help address these concerns, healthcare organizations should adopt security strategies driven by patient-safety and led by threat intelligence, An said.

“These strategies will align people, processes and technology across IT, clinical and OT environments. It’s important that healthcare organizations prioritize email and identity security by implementing phishing-resistant multifactor authentication, session and token monitoring, and least-privilege access,” she said.

These measures can effectively stop initial access before a breach occurs, she said.

Additionally, organizations should segment IT, clinical and OT networks to prevent or limit lateral movement and cascading failures, she said.

“It is also critical to strengthen visibility across the environment by using endpoint, network and identity detections to identify exfiltration and persistence early.”

Also important is organizations addressing known exploited vulnerabilities and actively exploited CVEs. “When patching isn’t possible, organizations should rely on compensating controls such as isolating affected systems, using virtual patching and monitoring protocols for abnormal behavior to reduce risk and limit potential impact.”

Looking ahead, identity and email will remain the primary attack surfaces, and legacy medical device and OT risk will worsen rather than improve, as the pace of device replacement continues to lag behind active exploitation, An said.