Executive Summary
The healthcare sector remains under intense pressure, experiencing malware volumes four times higher than the industry average. A critical finding from 2025-2026 data shows that 100% of vulnerabilities exploited in healthcare incidents were already listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. The persistence of these attacks is characterized by an 83% retention rate, indicating that adversaries repeatedly leverage the same structural weaknesses, such as legacy IoT devices and complex third-party vendor relationships.
Technical analysis highlights the exploitation of long-known flaws, including CVE-2021-36260 in Hikvision cameras and buffer overflows in UltraVNC. The Change Healthcare breach serves as a landmark case, where compromised credentials on a Citrix portal lacking MFA caused nationwide disruptions and led to a $22 million ransom payment. Current trends show that over 80% of data breaches in this sector now originate from third-party supply chain partners.
The business impact is severe, moving beyond IT metrics into clinical outcomes. Attacks have been linked to increased medical procedure complications, longer patient stays, and higher mortality rates. Organizations must prioritize the remediation of KEV-listed flaws and enforce strict MFA and segmentation policies to mitigate these persistent risks.