Iran Conflict Elevates Cyber Risk for Healthcare

United States and Israel military strikes on Iran could erupt into cyberattacks against the healthcare sector in the U.S. and elsewhere by Iranian sympathizers and proxies, experts warned Monday.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The life-and-death sensitivity of the healthcare sector, as well as its relative vulnerability to cyber incidents, makes it a target for rising attacks ranging from distributed denial of service, wiper malware, ransomware, data theft and other such assaults.

“The current threat landscape is heavily driven by hacktivist groups which operate across international infrastructure and are geographically dispersed,” said JP Castellanos, director of threat intelligence at security firm Binary Defense. “Their operational infrastructure isn’t dependent on Iranian connectivity” (see: Iranian Cyber Proxies Active But Not Nation-State Hackers).

The Health-Information Sharing and Analysis Center is closely tracking the U.S.-Iran crisis and the potential cyber spillover for healthcare and public health globally, said Errol Weiss, chief security officer at Health-ISAC.

“As tensions rise, we’re most concerned about disruptive attacks like DDoS campaigns and nuisance operations by Iran-aligned hacktivist and proxy groups. Those actors are likely to go after visible targets: hospital websites, patient portals, VPN gateways and other internet-facing systems, with the goal of disruption and psychological impact,” he said.

The Health-ISAC is also watching for activity that could affect clinical operations more directly such as attacks on remote access, OT, or IoT environments that support medical devices and critical hospital infrastructure.

“The risk is very real. A major cyber incident that degrades hospital networks, emergency communications, or key clinical systems isn’t just an IT problem – it’s a patient safety issue that can slow emergency care, delay surgeries and impact diagnostics,” he said. “In a high-tension geopolitical moment, healthcare becomes an attractive target because disruption has immediate human and political consequences.”

As the conflict continues to intensify, the healthcare sector faces a particularly elevated risk environment, Castellanos said.

“Healthcare organizations should be prepared for a broad range of activity. On the disruptive end, this includes website defacement, DDoS attacks, ransomware and wiper malware. On the espionage and extortion end it includes hack-and-leak operations disguised as data theft, repackaging or amplification of previously stolen data and opportunistic targeting of internet-exposed systems.”

“During periods of regional conflict, Iran-linked actors have consistently demonstrated a willingness to conduct disruptive and psychologically oriented operations, and healthcare is a high-value, high-visibility target,” he said.

“This includes potential proxy attacks from hacktivist groups operating on Iran’s behalf. The sector’s combination of sensitive patient data, life-critical systems, and historically under-resourced security programs makes it an attractive target both for operational disruption and for the kind of psychological impact Iran seeks to project.”

Iran-linked hacker group Handala claimed late February it targeted Clalit, Israel’s largest healthcare network, stealing patient data. “We expect further attacks against both Israeli healthcare providers and U.S. health networks, particularly organizations with affiliations to Israel or Jewish communities,” Castellanos said.

Healthcare organizations and other potential targets shouldn’t let news about Iran’s internet disruption create a false sense of reduced risk, Castellanos added. “Many of these actors are operating well outside Iran’s domestic network and can continue to operate independently.”

Castellanos advised that healthcare organizations review their detection capabilities, incident response plans and resiliency measures accordingly. “We assess the likelihood of opportunistic and potentially disruptive cyber activity has increased in the near term.”

Health-ISAC’s Weiss also said the evolving situation calls for healthcare and public-sector organizations to focus on resilience and critical best practices.

“First, harden external-facing assets: validate DDoS protection with ISPs and cloud providers, review access controls on VPNs and portals, and patch exposed systems where feasible,” he said. “Second, assume there may be periods of disruption and rehearse downtime procedures so clinicians can continue delivering safe care even if key systems are degraded or unavailable.”

Organizations should ensure they have clear, up-to-date incident-response and communications plans, including how they will work with third-party suppliers, vendors, government partners, as well as their ISAC “if something happens,” Weiss said.

“Geopolitical crises tend to accelerate opportunistic cyber activity; being prepared to operate through disruption is what will ultimately protect patients and public health.”