Black Kite published new data from the Black Kite Research Intelligence Team (BRITE) that shows certain ransomware groups are
disproportionately targeting healthcare organizations. Ransomware groups
Everest and Monti lead with 25% and 20.8%, respectively, of their victims in
healthcare. Notably, high-volume groups INC Ransom (21.7%) and BianLian (15%)
show a strong healthcare focus, making them especially dangerous to the
sector.
Since
last year, Black Kite research has reported that healthcare is the
third-most-targeted industry by ransomware groups, behind manufacturing and
professional services, and new data shows that within the market, physicians’
offices comprise 25% of the victims. General medical and surgical hospitals are
the second-most-targeted industry group, making up 22% of healthcare victims,
followed by other health professionals offices, such as dentists and outpatient
centers. And threats extend beyond ransomware. Research shows that overall
attacks on healthcare organizations surged by 32% year-over-year.
The
study shows the high-profile Change Healthcare attack was a tipping point for
ransomware groups. This incident marked a breaking point in the ransomware
ecosystem, exposing vulnerabilities in the traditional group-affiliate
structure and driving the shift to more aggressive, affiliate-dominated models.
While established groups may have bypassed organizations with a high human risk
factor, today’s ransomware groups target sectors based on ease of access and
ransom potential, often disregarding traditional ethical considerations.
“The
fallout from Change Healthcare fundamentally altered how ransomware groups
operate, making healthcare organizations prime targets,” said Ferhat
Dikbiyik, chief research and intelligence officer at Black Kite. “Threat
actors have refined their tactics to maximize efficiency, evade law
enforcement, and increase their chances of securing ransoms. These shifts in
both tactics and target criteria have made ransomware attacks more frequent,
unpredictable, and strategically devastating, especially in the healthcare
industry.”
In
the report, BRITE breaks down the affiliate ecosystem structure and victim
profiles. Most groups select victims based on technical vulnerability, industry
profile, and likelihood of paying the ransom. As a result, organizations that
are less protected and resource-constrained, such as small healthcare
businesses with less than $20 million in revenue, are prime targets. However,
large organizations with greater than $100 million in revenue are also at high
risk because of their ability to pay sizable ransom demands.
In an increasingly hostile
cyber landscape, it’s essential for healthcare organizations to take proactive
measures to avoid attracting ransomware groups. Preventing the devastating
impacts of ransomware and keeping systems and data available and protected is,
in many cases, a matter of life and death. BRITE recommends continuously
monitoring those factors that elevate risk – unpatched systems, compromised
credentials, and missing security controls, among others – monitoring vendor
and supplier ecosystems, and implementing robust cyber hygiene practices.
Ultimately, a proactive, layered approach can help healthcare organizations
safeguard their operations and, most importantly, keep their patients safe.
Download the State of Ransomware 2024: A Year of Surges and Shuffling.
