The Evolving Ransomware Landscape in Healthcare

The healthcare sector remains a prime target for cybercriminals, but the tactics are changing. Sophos’s State of Ransomware in Healthcare 2025 report, based on analysis of 292 healthcare providers, demonstrates a significant shift in both the technical and organizational factors contributing to successful attacks. While healthcare organizations are demonstrably improving their defenses against data encryption, adversaries are adapting, increasingly focusing on stealing sensitive patient data and leveraging extortion as their primary revenue model.

Capacity Gaps and Vulnerabilities: A Dangerous Combination

For the first time in three years, exploited vulnerabilities have overtaken phishing and other methods as the most common technical root cause of ransomware incidents, accounting for 33% of all attacks. This highlights the critical importance of robust vulnerability management programs. Simultaneously, a severe lack of skilled cybersecurity personnel – a capacity gap affecting 42% of victimized organizations – is exacerbating the problem. Nearly as many (41%) admitted to being aware of existing security weaknesses but lacking the resources to address them promptly.

Extortion Without Encryption: A Growing Threat

While the rate of data encryption during ransomware attacks has fallen to its lowest point in five years – impacting just 34% of incidents, down from a peak of 74% in 2024 – the threat hasn’t diminished. Instead, adversaries are increasingly opting for “extortion-only” attacks, where data is stolen but not encrypted, and a ransom is demanded for the prevention of its public release. This tactic tripled in 2025, now affecting 12% of healthcare providers. The sensitivity of patient data makes this approach particularly effective, as organizations are often willing to pay to avoid reputational damage and potential legal repercussions.

Economic Shift: Ransom Payments and Recovery Costs Decline

The financial dynamics of healthcare ransomware are undergoing a dramatic transformation. The median ransom demand has plummeted by 91%, from $4 million in 2024 to a mere $343,000 in 2025. Correspondingly, the median ransom actually paid has dropped from $1.47 million to $150,000 – the lowest figure reported across all industries surveyed. This trend extends to recovery costs as well, with the average cost (excluding ransom payments) decreasing by 60% to $1.02 million, down from $2.57 million the previous year. This suggests a tougher environment for cybercriminals seeking large payouts from healthcare organizations.

The Human Cost and Improving Resilience

Ransomware attacks take a significant toll on IT and cybersecurity teams. Nearly 40% of those affected reported increased pressure from senior leadership, and 37% experienced heightened anxiety and stress about future attacks. However, there’s a positive trend in recovery speed, with 58% of organizations now able to recover within a week, nearly tripling the 21% reported in 2024. Interestingly, the use of backups for data restoration has declined to 51% (from 72% in 2022), potentially indicating weaknesses in backup procedures or a lack of confidence in their reliability.

What strategies are healthcare organizations employing to accelerate recovery times, and why might backup utilization be decreasing despite these improvements? Are organizations relying more on alternative recovery methods, or are backup systems failing to meet expectations?

Learn more about the report and its findings here.

Frequently Asked Questions About Healthcare Ransomware