The healthcare sector is currently one of the most vulnerable to cyberattacks. The critical nature of its infrastructure, the sensitivity of medical data, and the proliferation of connected devices make it a prime target for cybercriminals.The National Cybersecurity Agency (ANSSI) has just published a report on cyber threats in this sector, highlighting recent trends and future challenges.

An Industry Under Intense Digital Pressure

ANSSI highlights the fragmentation and heterogeneity of healthcare stakeholders, which makes it difficult to ensure consistent security across information systems. This sector includes, in particular:

  • Healthcare facilities (hospitals, clinics, laboratories)
  • Healthcare product manufacturers (pharmaceuticals, medical devices)
  • IT and payment service providers

The growing shift toward digitization—including the implementation of electronic health records (EHRs), telemedicine, and connected medical devices—has significantly expanded the attack surface.

The main threats identified by ANSSI

1. Threats Motivated by Financial Gain: Ransomware Tops the List

Ransomware attacks remain the primary threat to the sector. Since 2020, they have resulted in system encryption, the exfiltration of sensitive data, and major disruptions at healthcare facilities. ANSSI has documented several incidents:

  • Centre Hospitalier Sud Francilien (2022): Encryption of critical systems, exfiltration of 11 GB of data, and disruption of neonatal and laboratory services.
  • Ascension Health (U.S., 2024): Hospital forced to revert to manual care management following a BlackBasta ransomware attack.

The exploitation of compromised VPN accounts, the lack of network segmentation, and weak backup policies contribute to the spread of these attacks.

2. Espionage and Theft of Medical Data

State-sponsored actors and cybercriminal groups specializing in espionage are targeting medical research data and critical infrastructure:

  • COVID-19: Groups linked to Russia, China, and North Korea have attacked research centers to steal information about vaccines and treatments.
  • Pharmaceutical industry: Ethypharm (France, 2024) was the victim of an attack targeting trade secrets.

3. Destabilization Attacks: DDoS and Sabotage

Hacktivist groups and politically motivated cybercriminals are targeting healthcare infrastructure to sow confusion:

  • DDoS (distributed denial-of-service) attacks against hospitals in France and abroad.
  • Massive leak of medical data intended to damage the reputation of institutions.

ANSSI's Recommendations for Improving Cybersecurity

In response to these threats, ANSSI is proposing a plan to strengthen cybersecurity that focuses on several key areas:

  • Access Security: Implementation of Multi-Factor Authentication and Restriction of VPN Access
  • Strengthening Backups: Offline Storage and Regular Restore Tests
  • Monitoring and Detection: Deployment of Logging and Anomaly Detection Solutions (SOC)
  • Resilience and Crisis Management: Incorporating Cyberattacks into Hospital Contingency Plans

Toward Enhanced Cybersecurity in Healthcare

The CaRe program (Cybersecurity, Acceleration, and Resilience of Healthcare Facilities), led by the French government, aims to enhance the level of protection for healthcare facilities through funding, audits, and specialized training.

The ANSSI report is a clear warning: cyberthreats in the healthcare sector are not inevitable, but they require a collective effort and strategic investments to ensure the continuity of care and the protection of patient data.

Is your organization prepared to deal with these threats? Contact us for a security audit that complies with ANSSI standards.