{"id":41552,"date":"2025-10-28T10:03:19","date_gmt":"2025-10-28T09:03:19","guid":{"rendered":"https:\/\/www.m-q.ch\/?p=22073"},"modified":"2025-10-28T15:48:13","modified_gmt":"2025-10-28T14:48:13","slug":"ransomware-im-gesundheitswesen-erpressungen-auf-hoechststand-loesegeldforderungen-gesunken-stress-bei-den-teams","status":"publish","type":"post","link":"https:\/\/www.organisator.ch\/en\/operational-excellence\/2025-10-28\/ransomware-im-gesundheitswesen-erpressungen-auf-hoechststand-loesegeldforderungen-gesunken-stress-bei-den-teams\/","title":{"rendered":"Ransomware in the healthcare sector: Extortion at all-time high, ransom demands down, stress among teams"},"content":{"rendered":"
\"\"\r\n
According to a study by Sophos, the healthcare sector is an increasingly frequent target of ransomware attacks. (Image: Depositphotos.com)<\/figcaption>\r\n<\/figure>\r\n

The healthcare sector is repeatedly the target of cyberattacks - partly because the high sensitivity of the data or the smooth 24\/7 operation is the basis for high ransom and extortion sums for cybercriminals. Reason enough for the IT security service provider Sophos to compile the annual \u201eState of Ransomware Healthcare 2025\u201c report. The results of the study are alarming: vulnerabilities are the most common cause of attacks and the number of extortions is at an all-time high. The study is based on the results of an independent survey conducted by Sophos among 3,400 IT\/cybersecurity executives in 17 countries in the Americas, EMEA and Asia Pacific, including 292 from the healthcare sector.\u00a0<\/p>\r\n

Vulnerabilities and capacity issues are the main causes of attacks<\/strong><\/h3>\r\n

For the first time in three years, respondents in the healthcare sector named exploited vulnerabilities as the most common technical cause of attacks (33%). This type of attack thus overtakes attacks due to compromised credentials (18%), which was the most common cause in 2023 and 2024.\u00a0<\/p>\r\n

Several organizational factors contribute to healthcare providers falling victim to ransomware. At 42 percent, the most common reason is a lack of staff or an insufficient number of cyber security experts monitoring systems at the time of the attack. This is closely followed by known security vulnerabilities, which played a role in 41% of attacks.<\/p>\r\n

Data encryption at five-year low, attack stops at five-year high\u00a0<\/strong><\/h3>\r\n

Encryption of healthcare data by cybercriminals has fallen to its lowest level in five years. Only 34 percent of attacks resulted in data being encrypted - the second-lowest figure in this year's survey and less than half the 74 percent recorded in 2024. At the same time, the proportion of attacks that were stopped before encryption reached a five-year high of 53 percent. This suggests that healthcare organizations are stepping up their defenses.\u00a0<\/p>\r\n

Extortion at an all-time high<\/strong><\/h3>\r\n

However, attackers are adapting: The proportion of healthcare organizations affected by pure extortion attacks, where no data was encrypted but a ransom was demanded, tripled from just 4 percent in 2022\/23 to 12 percent. This is the highest figure ever recorded in the study - presumably because medical data (e.g. patient data) is particularly sensitive.<\/p>\r\n

Ransom payments fall, trust in backups dwindles<\/strong><\/h3>\r\n

In 2025, only 36% of healthcare organizations paid the ransom demanded. This is a significant decline overall; in 2022, for example, this figure was still 61 percent. This makes this sector one of the four least likely to recover their data via ransom payments. At the same time, the use of backups for data reconstruction after an attack also fell to 51 percent. This could indicate greater resilience but also a lack of confidence in backup resilience.<\/p>\r\n

Ransom demands, payments and recovery costs fall drastically<\/strong><\/h3>\r\n

The level of ransoms in the healthcare sector has changed drastically:\u00a0<\/p>\r\n