{"id":72569,"date":"2025-12-19T07:35:49","date_gmt":"2025-12-18T23:35:49","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=72569"},"modified":"2025-12-12T08:37:58","modified_gmt":"2025-12-12T00:37:58","slug":"healthcare-ransomware-costs-fall-sharply-but-human-and-security-pressures-persist","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2025\/12\/19\/healthcare-ransomware-costs-fall-sharply-but-human-and-security-pressures-persist\/","title":{"rendered":"Healthcare ransomware costs fall sharply, but human and security pressures persist"},"content":{"rendered":"<p><strong><a href=\"https:\/\/www.sophos.com\/en-us\">Sophos<\/a>, a global player of innovative security solutions for defeating cyberattacks, released findings from its <a href=\"https:\/\/assets.sophos.com\/X24WTUEQ\/at\/cq9bfnh5g9kpw874qqg5th\/sophos-state-of-ransomware-in-healthcare-2025.pdf\">State of Ransomware in Healthcare<\/a> report.<\/strong><\/p>\n<p>It found that the sector has been making strides in tackling the threat of ransomware:<\/p>\n<ul>\n<li>Recovery times sped up: The percentage of organizations recovered within a week more than doubled from 21% in 2024 to 58% in 2025.<\/li>\n<li>Ransom payments and recovery costs are down: Between this year and last, the median ransom demand for healthcare providers declined by 91% to just $345,000, and recovery costs dropped to their lowest level in three years.<\/li>\n<li>Data encryption is declining: Data encryption fell to the lowest level in five years to just 34%.<\/li>\n<li>Fewer healthcare organizations are paying the ransom: The rate of healthcare organizations paying the ransom was nearly cut in half, and for those that did pay the ransom, over half paid less than the original demand. In 2025, just 36% of healthcare providers paid the ransom\u2014down from 61% in 2022<\/li>\n<\/ul>\n<p>However, ransomware is still a threat to the industry, presenting challenges for data recovery and frontline workers:<\/p>\n<ul>\n<li>Impact of healthcare staffing shortage: Multiple factors contribute to healthcare providers falling victim to ransomware, with the most common (42%) being a lack of people\/capacity (i.e., an insufficient number of cybersecurity expertsmonitoring\u00a0systems at the time of the attack), reflecting the impacts of the chronic healthcare staffing shortage.<\/li>\n<li>Extortion on the rise: The percentage of providers that had their data extorted and not encrypted tripled since 2023 \u2013 the highest rate reported across sectors.<\/li>\n<li>The human impact of ransomware is real: 37% of healthcare respondents mentioned increased anxiety or stress about future attacks, andnearly a quarter experienced staff absence due to this stress.\u00a0 \u00a0<strong>\u00a0<\/strong><\/li>\n<\/ul>\n<p><strong>What Sophos<\/strong><strong>\u00a0<\/strong><strong>is seeing<\/strong><strong>\u00a0<\/strong><strong>in healthcare<\/strong><strong>\u00a0<\/strong><\/p>\n<p>Over the past twelve months, Sophos X-Ops has\u00a0observed\u00a0ransomware activity across leak sites and found that 88 distinct threat groups targeted healthcare organizations. The most prominent groups targeting healthcare organizations based on leak site observations are: GOLD FEATHER\u00a0(Qilin), GOLD IONIC\u00a0(INC Ransom) and GOLD HUBBARD\u00a0(RansomHub). Sophos Incident Response and MDR cases reveal vulnerability exploitation as a primary vector in addition to the following: phishing, social engineering, brute force, drive by downloads, stolen credentials.<\/p>\n<p>\u201cHealthcare continues to face steady and persistent ransomware activity. Over the past year, Sophos X-Ops\u00a0identified\u00a088\u00a0different groups\u00a0targeting healthcare organizations, showing that even moderate levels of threat activity can have\u00a0serious consequences.\u00a0It\u2019s\u00a0also encouraging to see signs of stronger resilience. In the study,\u00a0nearly 60%\u00a0of providers reported they recovered within one week, up from just 21% last year, which reflects real progress in preparedness and recovery planning. In a sector where downtime directly affects patient care, faster recovery is critical, but prevention\u00a0remains\u00a0the\u00a0ultimate goal,\u201d\u00a0said Alexandra Rose, Director, Sophos Counter Threat Unit (CTU).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The percentage of organizations recovered within a week more than doubled from 21% in 2024 to 58% in 2025. \u00a0<\/p>\n","protected":false},"author":6,"featured_media":70227,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,18],"tags":[1481,3969,54,206],"class_list":["post-72569","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","category-white-papers","tag-cybersecurity","tag-it-in-healthcare","tag-security","tag-sophos"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/72569","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=72569"}],"version-history":[{"count":1,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/72569\/revisions"}],"predecessor-version":[{"id":72570,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/72569\/revisions\/72570"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/70227"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=72569"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=72569"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=72569"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}