Sophos, a global leader in cybersecurity solutions, has published its latest report, The State of Ransomware in Healthcare 2024, revealing that ransomware attacks on healthcare organisations have surged to a four-year high. According to the survey, which included 402 healthcare entities, 67% reported ransomware incidents in the past year, a notable increase from 60% in 2023. This rise in healthcare-specific attacks starkly contrasts with the overall decrease across all sectors, where ransomware attacks fell from 66% in 2023 to 59% in 2024.
The report underscores the increasing complexity and severity of these attacks, reflected in the extended recovery times reported by affected healthcare institutions. Only 22% of victims managed to restore their systems within a week, a steep drop from 47% in 2023. Moreover, 37% required over a month to fully recover—up from 28% in the previous year. John Shier, Field CTO at Sophos, noted that the sensitive nature of healthcare data and the critical need for continuous access make the sector a primary target for cybercriminals. He emphasised that healthcare organisations must adopt proactive, human-led approaches to effectively respond to these escalating threats.
In terms of financial impact, the mean recovery cost from a ransomware attack in healthcare reached $2.57 million in 2024, up from $2.2 million the previous year, and more than double the cost in 2021. The report also highlights the ongoing issue of ransom payments, with 57% of institutions that paid a ransom ending up paying more than initially demanded. Cybercriminals have increasingly targeted backup systems, with 95% of affected organisations reporting attempted compromises on their backups during the attacks. Institutions whose backups were compromised were over twice as likely to pay ransoms to retrieve their data.
Further findings show that compromised credentials and exploited vulnerabilities each accounted for 34% of the root causes of attacks. Insurance providers played a significant role in facilitating ransom payments, contributing in 77% of cases. The report, based on a survey conducted across 5,000 IT leaders in 14 countries and 15 industries, sheds light on the full scope of ransomware’s impact on healthcare, from the initial attack to its operational and financial repercussions.
These findings emphasise the critical need for healthcare organisations to bolster their cybersecurity measures, including adopting advanced technology and continuous monitoring, to effectively mitigate these ongoing and increasingly sophisticated ransomware threats.
