Securin

The ransom payment rate in healthcare is 68%–72% compared with about 40% in other sectors.

59% of cyberattacks on healthcare organizations involve ransomware.

Hospitals can lose $1,000,000 to $2,000,000 per day during operational disruptions caused by cyberattacks.

VPN and remote access systems account for roughly one-third of initial access vectors in healthcare cyberattacks.

56% of cyberattacks on healthcare organizations target U.S.-based organizations.

Access to healthcare systems can be purchased for as little as $2,000 to $50,000.

Healthcare organizations are being hit by cyberattacks about every 10 hours.

Medical records sell for $250 to $1,000 each on illicit markets.

Qilin claimed the most victims in 2025 (835), followed by Akira (650), Cl0p (517), Play (363), INC (334), Safepay (306), Lynx (253), RansomHub (233), DragonForce (181), and Babuk (176).

2025 ransomware market share by group: Qilin (23%), Akira (18%), Cl0p (14%), Play (10%), INC (9%), Safepay (8%), Lynx (7%), RansomHub (6%), DragonForce (5%).

Ransomware victims by industry: Commercial facilities (997), manufacturing (846), information technology (818), healthcare & public health (473), financial services (340), education (266), transportation &logistics (263), government facilities & public sector (253), food & agriculture (181), hospitality (146), energy (144), communications (99), retail (9), entertainment (1), legal (1).