The threat landscape facing health care organizations and their managed service providers (MSPs) in 2026 is constantly becoming more dangerous.
Businesses and service providers in the field are increasingly popular targets for attackers. The attack perimeter for health care organizations is rapidly expanding beyond internal threats to involve third parties, especially MSPs. At the same time, attackers are ramping up breach attempts, which increases the risk of regulatory exposure for organizations in health care and the MSPs that deliver services to them.
Numbers tell the story:
- According to Comparitech, ransomware attacks on health care businesses rose 35% in Q1 2026 compared to Q4 2025.
- The 2026 Verizon Data Breach Investigations Report (DBIR) found that data breaches with third-party involvement — including service providers — increased by 60% compared to the number in the 2025 report.
- Law firm BakerHostetler reported in its 2026 Data Security Incident Response Report that third-party vendors caused 25% of all cybersecurity incidents.
With threats constantly increasing in number and severity, MSPs in the health care field need to anchor their risk plans around five pervasive threats:
- Supply chain attacks targeting MSP infrastructure.
- Ransomware-as-a-service campaigns against health care.
- Internet of medical things (IoMT) device exploitation.
- Credential theft via social engineering.
- Insider threats.
1. How are supply chain attacks targeting MSP infrastructure?
The most consequential shift in 2025 for health care cybersecurity was that attackers focused increasingly on breaching MSPs in the health care field rather than just targeting health care organizations themselves.
For instance, ransomware gangs can exploit vulnerabilities on an MSP’s remote monitoring and management (RMM) instance. Once inside the MSP’s environment, the attacker can conduct reconnaissance across multiple client estates, then deploy ransomware and exfiltrated data downstream into health care and other client networks. A single operational gap turns a trusted RMM tool into a distribution channel for ransomware against every client the MSP serves.
Operational implications for MSPs: Patch discipline on RMM, professional services automation (PSA) and remote access tools is now the primary line of defense for an MSP to prevent a multiclient compromise.
MSPs with documented multifactor authentication (MFA), per-client credential vaulting and segmented management planes can see 20% to 35% better cyber insurance pricing than those without those controls. The mitigation is architectural: service providers need to segment the MSP environment from client environments, vault credentials per client, enforce phishing-resistant MFA on all remote access and stay current on every tool patch.
2. Which ransomware-as-a-service groups are targeting health care?
Health care was one of the most frequently targeted sectors for ransomware in 2025. Comparitech logged 293 ransomware attacks on health care providers and 130 on health care businesses (including vendors, billing companies and technology providers) in the first three quarters of 2025, with attacks on health care businesses rising 30% year over year.
The ransomware-as-a-service model is driving the volume. After RansomHub’s leak site went dark in April 2025, affiliates moved to Qilin, which saw a 280% jump in attack claims and recorded its 700th attack of 2025 by October, according to Comparitech. From Q1–Q3 2025, the five most active ransomware strains targeting health care were Qilin, INC Ransom, RansomHub, SafePay and Medusa, Comparitech found.
MSPs should be particularly aware of several 2025 incidents when developing a risk plan:
- Episource (US), January 2025: 5,418,866 patients notified after a health care technology vendor breach. Sharp Health Care and Sharp Community Medical Group issued downstream notifications.
- DaVita (US), March 2025: 2,689,826 patients affected. Interlock claimed responsibility and exfiltrated 1.51 TB of data.
- Frederick Health Hospital (US), January 2025: ransomware forced ambulance diversions and affected 934,326 patients.
- Covenant Health, May 2025: Qilin exfiltrated 852 GB of data and compromised records for 478,188 patients. Dwell time inside the environment was eight days.
- Kettering Health, June 2025: Interlock caused system outages and procedure cancellations.
Two patterns matter operationally. First, dwell times are short. Covenant Health’s eight-day window from initial access to detection is now typical for health care ransomware. Second, data exfiltration almost always precedes encryption. The implication for MSPs is that backup-only recovery does not solve the problem. The data is already on a leak site.
Operational implications for MSPs:
The recovery requirement is malware-free recovery. Restoring a clean backup that contains the original payload simply restarts the attack. Acronis Safe Recovery scans every backup image for malware and vulnerabilities before allowing restoration to the production network, which closes the reinfection window that backup-only solutions leave open. For MSPs delivering ransomware recovery to health care clients, that is the difference between a six-hour recovery and a six-week reinfection cycle.
Acronis endpoint detection and response (EDR) and extended detection and response (XDR) add a layer above backup: detection of lateral movement across managed endpoints, correlation of suspicious activity across client environments and the ability to identify ransomware staging before encryption begins.
3. How are IoMT devices being exploited in health care attacks?
The IoMT attack surface continues to rapidly expand.
The riskiest device category is imaging. Those devices typically run on legacy operating systems that the manufacturer has not patched and often cannot be patched without FDA validation cycles. The vulnerable devices frequently sit on flat hospital networks with broad access to clinical workstations.
FDA-issued cybersecurity alerts in 2025 underscored the operational risk. On January 30, 2025, the FDA warned about vulnerabilities in Contec CMS8000 and Epsimed MN-120 patient monitors that could allow unauthorized access and remote control of the devices.
Operational implications for MSPs:
Medical device patching is not the MSP’s responsibility, but compensating controls are, including network segmentation between IoMT and clinical workstations, east-west traffic monitoring and detection of anomalous device communication. The flat-network problem is the most consequential gap — a compromised imaging workstation that can reach clinical desktops and billing puts the entire hospital at risk.
Endpoint protection needs to run without disrupting bedside performance. Acronis Cyber Protect Cloud offloads security scans to the cloud rather than the endpoint, making universal EDR coverage feasible on PACS viewing stations and workstation-on-wheels carts.
4. Which credential theft and social engineering tactics target health care?
Credentials are the new perimeter for health care attackers. Credential abuse remained the most common initial attack vector in the Verizon 2026 DBIR at 36% of breaches. Phishing was most common initial breach vector in IBM’s Cost of a Data Breach Report 2025, but vendor and supply chain compromise and stolen credentials followed closely behind.
Several 2025 campaigns that should be on every health care MSP’s radar:
Raccoon0365 (Microsoft, September 2025). This phishing-as-a-service operation sold subscription kits to harvest Microsoft 365 credentials. Microsoft, in cooperation with Health-ISAC, dismantled the operation after attackers used the kits to steal approximately 5,000 credentials across 94 countries and to breach at least 20 American hospitals. The health care focus was severe enough that Health-ISAC formally joined Microsoft’s lawsuit.
Help-desk vishing campaigns. HHS Health Sector Cybersecurity Coordination Center (HC3) issued a sector alert documenting threat actors calling MSP and health care help desks while impersonating finance department employees, claiming a broken mobile device and requesting MFA re-enrollment to a number the threat actors control. Attackers arrive with authentic employee information, including Social Security and corporate ID numbers. UNC3944 (also known as Scattered Spider) has used this exact tactic to breach Fortune 500 environments through MSP help desks.
MFA fatigue attacks. A documented case in early 2025 involved a health care IT administrator targeted with more than 200 MFA push notifications in an hour. The administrator eventually approved one, and the attacker gained access to patient records.
Operational implications for MSPs:
The MSP help desk is a primary attack surface — identity verification for password resets and MFA changes must go beyond knowledge-based questions. Push-based MFA is no longer sufficient for privileged accounts; FIDO2 or hardware tokens are the baseline for any account touching a health care client environment. Email security is the layer that determines whether the next Raccoon0365-class campaign harvests credentials before you can act.
5. How significant are insider threats in health care?
Insider threats remain the most underestimated risk in health care cybersecurity. The 2026 Verizon DBIR found that nearly 20% of confirmed health care breaches involved internal actors. The Ponemon Institute’s 2026 Cost of Insider Risks Global Report put the average annualized cost of an insider breach for health and pharmaceutical at $28.8 million.
Most incidents are not malicious. The Verizon DBIR reports that health care, in fact, has been among the industries most affected by employee mistakes. “Miscellaneous errors” has been among the top three incident patterns in health care every year since 2014. Common patterns include curiosity-driven patient record access, accidental email disclosure and informally shared credentials between clinical staff.
Operational implications for MSPs:
Data loss prevention (DLP) belongs in the health care stack. Acronis DLP (add-on tier) monitors how PHI moves through endpoints and email, catching negligent insider incidents before they become OCR-reportable breaches. Behavior analytics matters more than perimeter controls; annual training is a floor, not a ceiling.
How should MSPs sequence their 2026 health care defense plan?
This quarter: Patch their own infrastructure. Audit every RMM, PSA and remote access tool for current versions. Enforce phishing-resistant MFA on every account with access to a client environment. Implement help-desk identity verification protocols that do not rely on knowledge-based questions.
Next quarter: Move every health care client to malware-aware backup recovery. The single biggest gap in health care MSP stacks is backup that restores the original infection. Acronis Safe Recovery closes that gap. Deploy EDR or XDR with cloud-offloaded scanning to clinical workstations where on-endpoint performance is a constraint.
Through 2026: Build segmentation around IoMT devices. The MSP does not own the medical devices, but the service provider does own the network architecture that contains them. Deploy DLP for health care clients handling PHI at volume. Move security awareness training from annual to continuous.
The thread that connects all five threats is the same: visibility across the attack surface and the ability to recover cleanly when prevention fails. The MSPs that consolidate detection, backup and recovery onto a single platform are the ones that will sustain the operational tempo health care cybersecurity now requires.
Frequently asked questions
What are the top 5 cybersecurity threats in health care in 2026?
The five threats every health care MSP should plan against in 2026 are: supply chain attacks targeting MSP infrastructure (third-party involvement in breaches increased by 60% year over year per the Verizon DBIR 2026); ransomware-as-a-service campaigns from groups including Qilin, INC Ransom, RansomHub, SafePay and Medusa; IoMT device exploitation; credential theft via phishing and help-desk social engineering (Raccoon0365 alone breached at least 20 US hospitals); and insider threats (almost 20% of health care breaches involve internal actors per Verizon DBIR 2026).
What agency is in charge of cybersecurity in health care?
Two federal agencies share primary responsibility. The HHS Office for Civil Rights (OCR) enforces HIPAA’s Security Rule and investigates breaches affecting Protected Health Information, including Business Associate liability. The Cybersecurity and Infrastructure Security Agency (CISA) issues advisories and coordinates incident response for health care as critical infrastructure. The HHS Health Sector Cybersecurity Coordination Center (HC3) issues sector-specific threat alerts, and the FDA regulates the cybersecurity of medical devices, including the January 30, 2025, Contec CMS8000 patient monitor advisory.
Why are MSPs targeted in health care ransomware attacks?
MSPs sit upstream of multiple health care clients and hold privileged remote access to each. A single MSP breach lets an attacker pivot into every downstream client environment, which is why MSPs are now classified as supply chain risk by both Verizon and Cyble. One set of unpatched RMM vulnerabilities can turn an MSP’s management infrastructure into a distribution channel for ransomware across multiple client environments simultaneously.
How do IoMT devices get exploited in hospitals?
IoMT devices typically run legacy operating systems that the manufacturer has not patched. They often cannot be patched without FDA validation cycles and sit on flat hospital networks with broad access to clinical workstations. Attackers exploit known vulnerabilities in imaging systems, patient monitors and other connected devices to gain initial access, then use that foothold to move laterally.
What is the most essential function of health care cybersecurity?
Recovery. Health care environments cannot accept extended downtime, and roughly three-quarters of health care ransomware cases now include data exfiltration before encryption, so the data is on a leak site regardless of whether the encryptor runs. The single highest-value control for a health care MSP is malware-aware backup recovery that scans backup images for the original payload before restoration to the production network. Without that scan, restoring a clean backup that contains the malware simply restarts the attack.
How do MSPs prevent supply chain attacks against health care clients?
Four controls move the needle: patch RMM, PSA and remote access tools on a defined SLA; separate the MSP’s own credential store from client credential stores so a compromise of one does not cascade; enforce phishing-resistant MFA on every account that touches a client environment; and segment the MSP’s management plane from production client environments. Underwriters now price these controls into cyber insurance, with 20% to 35% premium differentials between MSPs that document them and MSPs that do not.
How is AI changing health care cybersecurity threats?
AI shows up on both sides of the equation in 2026. Attackers use AI for voice cloning in vishing campaigns (FBI alerts on AI-driven impersonation of senior officials in 2025), for generating convincing phishing content at scale and for accelerating reconnaissance inside compromised environments. Defenders are using AI for behavior baselining, anomaly detection and faster correlation across signal sources.
See how Acronis Cyber Protect Cloud combines backup, EDR, XDR and DLP into a single agent for health care MSP delivery: Explore Acronis Cyber Protect Cloud for MSPs →
Sources
- Comparitech, Healthcare Ransomware Roundup Q1 2026
- Verizon, 2026 Data Breach Investigations Report (DBIR)
- BakerHostetler, 2026 Data Security Incident Response Report
- IBM, Cost of a Data Breach Report 2025
- Ponemon Institute, 2026 Cost of Insider Risks Global Report
- U.S. Food and Drug Administration, Contec CMS8000 and Epsimed MN-120 patient monitor cybersecurity advisory, January 30, 2025
- U.S. Department of Health and Human Services, Health Sector Cybersecurity Coordination Center (HC3) sector alert
- Microsoft Threat Intelligence and Health-ISAC, Raccoon0365 disruption, September 2025
Click Here For The Original Source.
