What is Ransomware

The attack lifecycle.

Phase 1 — Initial access

Attackers gain initial foothold. Common vectors: phishing email with malicious attachment, compromised remote access credentials (VPN, RDP), exploited vulnerabilities in internet-facing services, and supply chain compromise through vendor software. Healthcare-specific vectors include medical device vulnerabilities and research network exposures.

Phase 2 — Lateral movement

After initial access, attackers move laterally within the network — escalating privileges, identifying valuable systems (EHR databases, backup systems, file servers), and preparing for encryption deployment. Modern ransomware attacks often have weeks of lateral movement before encryption event. Good detection during this phase can prevent the ransomware event entirely.

Phase 3 — Data exfiltration (double extortion)

Modern ransomware typically includes data theft BEFORE encryption. Attackers exfiltrate data to their infrastructure; if victim refuses to pay for decryption, they threaten data publication. This "double extortion" model increases pressure on victims and complicates decision-making. Backups can restore systems but can't prevent data publication threats.

Phase 4 — Encryption deployment

Simultaneous encryption of files across compromised systems. Typically includes attempts to corrupt or delete backups. Ransomware note appears demanding payment in cryptocurrency (typically Bitcoin or Monero) within specified timeframe.

Phase 5 — Extortion and resolution

Negotiation with attackers (typically via third-party incident response firms), decision about whether to pay, and recovery operations (restore from backups if available, decrypt with paid key if payment is made, or rebuild from scratch). Business disruption typically spans weeks to months. Patient care impact in healthcare attacks can be severe.

The structural reasons healthcare faces disproportionate ransomware attacks.

Patient care urgency creates payment pressure. Healthcare organizations can't operate without their systems — patient care stops when EHR is down. This urgency creates stronger incentive to pay than other industries where downtime is inconvenient but not life-threatening.

PHI has high black market value. Medical records are among the most valuable data on the black market — higher value than credit card data. Even if ransomware is resolved, stolen data has ongoing resale value for attackers.

Often-weaker security posture than financial services. Healthcare IT budgets are typically lower than financial services IT budgets; security investment has historically been lower. This gap is closing but hasn't closed.

Attack surface complexity. Healthcare environments include medical devices with limited patchability, research networks with historical openness, telehealth infrastructure with rapid deployment, and extensive vendor ecosystem — each creating potential attack vectors. CISA healthcare sector guidance.

Why ransomware is almost always a reportable breach.

HHS has issued guidance indicating that ransomware attacks are typically breaches under HIPAA. The rationale: ransomware encryption involves unauthorized access to PHI. The four-factor risk assessment must still occur, but the default posture should be that ransomware is a reportable breach unless strong evidence shows otherwise.

With double extortion, the analysis is even clearer — confirmed data exfiltration is unambiguous unauthorized access. Modern ransomware almost always involves data exfiltration.

Notification obligations follow. Individual notification, HHS notification (within 60 days for 500+ person breaches, annual for smaller), and media notification (500+ in single state/jurisdiction). See our HIPAA breach notification page for notification detail.

Controls that materially reduce ransomware risk.

Endpoint detection and response (EDR)

Modern EDR platforms detect ransomware behavior patterns before encryption occurs and can contain threats. Substantial advance over legacy antivirus. See our endpoint protection page and ransomware protection page.

MFA everywhere

Multi-factor authentication for remote access and privileged access prevents the credential compromise pattern that drives many ransomware attacks. MFA is now baseline expectation in cyber insurance and often cited in HHS guidance.

Immutable backups

Backup architecture that prevents attackers from corrupting backups even with privileged access. Air-gapped backups, immutable cloud backups, and offsite replication with separate credentials. Modern ransomware specifically targets backups; backup architecture must assume this attack vector. See our disaster recovery page.

Managed detection and response

24/7 threat detection capability that catches lateral movement before encryption. Most ransomware attacks have weeks of lateral movement — detection during this phase prevents encryption. See our managed threat detection page.

Patch management and vulnerability management

Many ransomware attacks exploit known vulnerabilities with available patches. Systematic patch management and vulnerability scanning address this attack vector. See our patch management page and vulnerability scanning page.

Incident response capability

When attacks occur, established incident response capability matters — pre-negotiated relationships with incident response firms and legal counsel, documented playbook, and decision authority. Organizations with established IR capability handle incidents substantially better than organizations making decisions during crisis. See our incident response page.