Ransomware Intelligence / Sectors / Healthcare
Sector
Ransomware in Healthcare
Hospitals, clinics, health systems, payers and medical device makers.
- 40claims, 7 days
- 139claims, 30 days
- 365claims, 90 days
- 2026-11-04most recent claim
Leak-site listings are claims made by criminals, not confirmed incidents. Sector is assigned from the public listing with an automated classifier and a confidence score; 12% of claims in the last 30 days are not yet classified. If a classification looks wrong, tell us.
Activity, last 26 weeks
New leak-site claims per week against healthcare organisations.
Most active groups, last 90 days
- the gentlemen 46
- n0n 18
- storm 17
- qilin 16
- booba team 15
- shinyhunters 14
- direwolf 13
- kazu 12
- inc ransom 11
- krybit 10
Countries, last 90 days
- United States 209
- Unknown 15
- Germany 12
- Brazil 11
- Canada 11
- Italy 8
- Argentina 7
- Australia 6
- United Kingdom 6
- India 6
- Taiwan 6
- Peru 5
- Spain 4
- PK 4
- Türkiye 4
In the news
Recent ransomware stories in the security press about healthcare organisations, picked by keywords in the headline.
- HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network
- HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network
- Michigan State cyber incident claimed by ransomware gang behind recent hospital attack
- Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses
- UNM Health ransomware attack disrupts patient care, surgeries
- Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack
Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked
Vulnerabilities with known ransomware use
From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog is not sector-specific; if you run the product, patch it.
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Weekly brief
Weekly briefs cover manufacturing, critical infrastructure and K-12 education today. Subscribe to one of those, or write to info@securitysnares.com if you would read one for healthcare.
Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 12 hours ago
Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology