An Underground View of Healthcare

An Underground View of Healthcare

We continue to cover research from Intel 471. This time, the company prepared a report on threats to life sciences and health care from January to October 2025. According to Netwrix, the number of health care organizations that suffered losses of at least $200,000 quadrupled year over year, while the share of organizations with losses exceeding $500,000 increased from 2% in 2024 to 12% in 2025. Meanwhile, according to another study cited by Intel 471, the average cost of a healthcare data breach reached $7.42 million.

Health Information Medical data, including health records, Social Security numbers, insurance information, and payment data, is highly valuable to threat actors and can be used in various criminal schemes. For example, in mid-September 2025, one seller offered a 2.3 TB dataset of medical records, some of which related to Brazilian military police personnel.

Infrastructure Access From January through September 2025, researchers identified at least 48 initial access brokers targeting organizations in the sector. Credentials for corporate VPNs were the most common type of access. For example, in early January 2025, one seller offered credentials for access to Cisco and Fortinet VPNs, as well as Microsoft's web-based Remote Desktop service (RDWeb), affecting more than 40 organizations across a wide range of sectors, including four healthcare institutions in Brazil, India, the UAE, and Venezuela.

Supply Chain Attacks Healthcare organizations rely heavily on external providers, ranging from health information systems to equipment and payment services. Compromising these providers can lead to data theft, ransomware distribution, and operational disruptions at connected organizations. According to Proofpoint, the share of healthcare organizations that experienced a supply chain attack declined from 68% in 2024 to 44% in 2025. At the same time, 87% of organizations affected by such attacks experienced disruptions to healthcare delivery. For example, in February 2025, one threat actor claimed to have compromised a software developer serving healthcare institutions, affecting “hundreds of pharmacy and healthcare clients”.

Ransom Payments Approximately 470 ransomware attacks were recorded during the reporting period, and more than 83% of healthcare victims were organizations with low revenues or did not disclose their revenue. The share of organizations paying ransoms also declined, from 61% in 2022 to 36% in 2025. The average ransom demand fell by 91%, from $4 million in 2024 to $343,000 in 2025, while actual payments declined from $1.47 million to $150,000.

Hacktivists Hacktivists target the sector for political, ideological, and social reasons, ranging from dissatisfaction with drug prices or pharmaceutical companies' practices to attempts to disrupt the operations of healthcare organizations in a particular region. Common methods include DDoS attacks, website defacement, and the publication of confidential data.

Other Threats Intel 471 also examines threats from insiders and social engineering. For example, in January 2025, one threat actor claimed to be an employee of an unspecified multinational pharmaceutical company with revenue exceeding $50 billion and offered their services as an insider. In another case, on July 1, 2025, OutcomesOne detected a phishing attack in which a threat actor gained access to an employee's mailbox for approximately one hour. The medical data of approximately 150,000 people may have been compromised.