Indeed, in 2024, healthcare was the most expensive industry for responding to and recovering from data breaches – as it has been every year since at least 2011, according to a report from IBM. The average cost for a healthcare breach was $9.8 million, while finance ranked second at $6.1 million.

Being the target of cybercriminals is obviously an uncomfortable and difficult position for any executive. Sometimes, making the best choice is largely a question of opting for the lesser of two evils. When faced with direct threats from ransomware criminals, the following are a few considerations hospital and health system leaders should consider:


• Perform a thorough risk analysis: Work closely with a team of IT security experts, legal counsel, law enforcement, federal authorities, and external experts in cybersecurity threats to understand the advantages and disadvantages of paying up as well as holding out. Ultimately, the decision around paying a ransomware threat is not a technical one, but a business decision.

• Understand who you’re dealing with: Looking into the history of the threat actor and what they have done in the past. Many will likely do what they say (i.e., leave you alone) – if you pay up. But obviously it’s impossible to take them at their word. Try to ascertain whether there is any pattern to how the attackers are likely to respond, regardless of which response you choose.

• Don’t go it alone: Layer security technologies on top of one another to strengthen your defenses. For example, use an advanced anti-malware solution, and outsource 24x7 monitoring services to a reliable third-party expert. Also important: Your own people are your best defense, so ensure that they receive cybersecurity training.

• Prepare with tabletop exercises: While nothing can totally prepare health systems for the real thing, the process of practicing a response to security threats helps employees get in the right mindset and become familiar with the type of decision-making that will be required. Practice often, use a variety of common incident scenarios, and involve everyone – internal and external teams.

• Do not forget your backups: Majority of successful ransomware recovery are due to regular tested backup and recovery processes.

The unfortunate reality for health systems and hospitals today is that ransomware attacks are less a question of “if” and more a question of “when.” While paying the ransom may seem like a quick fix to restore critical services and protect patient data, it comes with considerable risks – both business and legal risks. As healthcare continues to be a prime target for cybercriminals, driven by the sector’s reliance on vulnerable legacy systems and highly valuable patient information, it is essential for healthcare leaders to be proactive. Ultimately, informed decision-making is critical to navigating the complex and dangerous landscape of ransomware attacks. And healthcare organizations should prepare for them as if they will be confronted with one tomorrow.

Cyber Security Homepage