Radiology Departments at High Risk for Ransomware

Radiology departments are facing an elevated risk of ransomware attacks, exemplified by the CHAOS group's July 2026 claim of exfiltrating 655GB of data from Radia Inc. The healthcare sector remains the most targeted critical infrastructure sector, with actors like Medusa, Gunra, and Qilin actively exploiting vulnerabilities in network appliances and legacy medical infrastructure. There is a notable strategic shift toward extortion-only models, where attackers skip encryption in favor of leaking sensitive medical imaging and patient records to pressure victims into payment.

Technical analysis shows that actors are heavily exploiting authentication bypass vulnerabilities in Fortinet devices (CVE-2024-55591 and CVE-2025-24472) for initial access. Radiology departments are particularly vulnerable due to high data density, a sprawl of connected digital imaging devices (PACS/RIS), and unpatched legacy operating systems in MRI and CT scanners. The impact of these attacks extends beyond data loss to significant clinical disruption, forcing emergency care delays and manual reporting workflows.

The business impact is severe, encompassing multi-million dollar legal settlements, HIPAA notification obligations, and supply-chain interruptions. As ransom payments decline and recovery speeds improve for encryption-based events, defenders must pivot toward detecting the stealthier behaviors associated with pure data extortion and lateral movement through living-off-the-land techniques.