Hospital cybersecurity is no longer an exclusively technological issue. In a hospital, an IT incident can delay a procedure, interrupt a diagnostic test, block medication dispensing, or hinder access to essential clinical information for decision-making. Therefore, protecting healthcare systems is not just about preserving data: it means maintaining the ability to care for patients safely and continuously.
This is not a problem exclusive to any particular healthcare system. Hospitals worldwide face similar challenges: increasingly connected infrastructures, legacy systems that are difficult to update, medical devices with long life cycles, growing reliance on external providers, and adversaries evolving at the pace of new technologies.
What varies between countries and organizations is their level of maturity, their resources, their governance models, and their response capacity. The risk, however, is shared.
From WannaCry to Hospital Clínic: when the incident reaches the patient
In May 2017, the WannaCry ransomware attack affected numerous organizations in the British healthcare system, including the NHS. The system disruption forced the cancellation of appointments and procedures and highlighted an uncomfortable reality: technology unavailability can directly translate to healthcare activity.
Six years later, in March 2023, the cyberattack on Hospital Clínic in Barcelona again demonstrated this connection. The incident affected hospital services and related centers, forcing the suspension or rescheduling of consultations, tests, and treatments, while prioritizing the continuity of essential services. Subsequently, data stolen during the attack was also published.
Both cases show that the severity of a healthcare incident cannot be measured solely by the number of affected devices, exposed records, or recovery costs. The consequences on clinical activity, professionals, and patients must also be considered.
In healthcare, recovery time matters, but so does which services become unavailable, for how long, and what alternatives exist to maintain care.
The fundamental question, therefore, is not only whether a hospital can suffer a cyberattack. It is whether it can continue providing safe care when its systems stop functioning as they should.
Healthcare data: the impact of a breach beyond the incident
Data protection is the other major dimension of the problem. Healthcare information is especially sensitive because it describes intimate aspects of individuals and can generate consequences that persist long after an incident has been technically resolved.
The attack on Medibank, one of Australia’s main private health insurance providers, in 2022, exposed information of approximately 9.7 million customers. Some of the stolen data ended up being published, including personal and health details.
This type of incident demonstrates that the risk does not end when systems are recovered. The exposure of medical information can facilitate fraud, extortion, and impersonation, in addition to causing personal and reputational damage that is difficult to repair.
The evolution of ransomware has also changed the scenario. Attackers no longer need to limit themselves to encrypting systems and demanding a ransom to restore availability. They can steal information and threaten to disclose it, pressuring the organization even if it has backups and manages to restore its services.
Therefore, a healthcare strategy must simultaneously protect system availability, data confidentiality, and the integrity of clinical information. None of these dimensions can be addressed in isolation.
A hospital is much more than a computer network
The complexity of the healthcare environment explains part of its exposure.
A hospital’s infrastructure combines traditional corporate systems—identity, email, administrative applications, and databases—with clinical applications, laboratory systems, imaging diagnostic equipment, monitoring devices, and connected medical technologies.
This convergence between IT, IoT, and IoMT (Internet of Medical Things) expands the attack surface and multiplies dependencies. A connected device can become an entry point, a compromised system can facilitate movement to other segments, and an incident in a provider can affect services the hospital considers critical.
Moreover, not all assets can be managed like a conventional computer.
A medical device may have a lifespan of many years and depend on certified software, manufacturer-validated configurations, or very limited maintenance windows. An apparently simple update may require prior testing, coordination with the provider, and guarantees that it will not affect its clinical operation.
In certain cases, shutting down, restarting, or modifying equipment is not an immediate option.
This introduces an essential difficulty: the organization may know of a vulnerability and yet not be in a position to immediately install the definitive fix.
Therefore, it is not enough to have an inventory of vulnerabilities and a patching schedule. It is necessary to understand which assets are truly critical, how they connect to each other, what exposure they present, and what measures can reduce risk while preparing a definitive solution.
Dependence on the ecosystem: the risk doesn’t end at the hospital doors
Healthcare also depends on a technological and operational ecosystem that includes software providers, cloud services, manufacturers, insurers, laboratories, payment platforms, and process management companies.
The attack on Change Healthcare in the United States in February 2024 illustrated the impact of this interdependence. The disruption of a central platform for managing healthcare transactions affected processes such as claims processing, payments, and prescription management, with consequences extending far beyond the directly attacked organization.
The lesson is clear: an entity can have reasonably robust security controls and still be exposed to a disruption originating from a third party on which it depends.
Risk management must therefore consider not only its own assets but also technological and operational dependencies, service concentration, provider access, and alternative procedures to maintain activity.
Healthcare resilience requires knowing what happens if an external service becomes unavailable and how long the hospital can operate without it.
Artificial intelligence accelerates the challenge
Artificial intelligence is transforming both defensive capabilities and attackers’ possibilities. It can help analyze large volumes of information, identify patterns, automate tasks, and reduce the time needed to discover and exploit weaknesses.
Data published by Google Threat Intelligence Group in September 2026 points to an evolution that deserves attention. The number of vulnerabilities disclosed monthly rose from 5,045 in January to 10,740 in August of that year. The monthly average of vulnerabilities observed as exploited went from 10.5 in 2025 to 18 between January and August 2026.
These figures require context: more vulnerabilities being disclosed does not mean all are exploitable or represent the same risk. In fact, only a small proportion of disclosed vulnerabilities were observed in active exploitation. However, the trend reinforces a relevant concern: defenders need to identify and reduce exposure more quickly, especially when a vulnerability affects a critical asset and there is evidence it is being used by attackers.
AI also opens the door to new forms of automation through agents capable of executing tasks and utilizing tools. An agent is not simply an assistant that answers questions: depending on its permissions, it can interact with systems, query resources, and perform actions.
In September 2026, an incident in Australia highlighted the risks associated with the use of artificial intelligence agents. One of these agents accessed unauthorized public and non-public files from a Medicare statistics portal. Authorities indicated there was no evidence of access to patient personal data or a broader compromise of the healthcare network.
It is important to maintain that distinction: the case does not demonstrate access to medical records, but it does illustrate why new automated capabilities require clear limits, access controls, and oversight mechanisms.
The question is no longer solely how to protect systems against conventional attacks. We must also ask how to control the agents operating on them, what permissions they need, what information they can access, and how to verify the actions they perform.
The Defender’s Window: buying time when we can’t patch immediately
In the face of this acceleration, defenders need to take advantage of a window of opportunity: the time between identifying a weakness and its possible exploitation, or between detecting a threat and applying an effective mitigation.
Greg Brockman, president and co-founder of OpenAI, has contributed to the debate on the defender’s window of opportunity against the acceleration of artificial intelligence capabilities: The Defender’s Window. The idea is especially relevant for critical sectors like healthcare, where the speed at which threats evolve contrasts with the difficulty of modifying certain systems without affecting care continuity.
In a hospital, we cannot always immediately fix a vulnerability. But we cannot afford to wait to reduce the risk it represents.
Here, compensatory measures become particularly important. When an update cannot be applied immediately, organizations must evaluate alternatives that temporarily reduce exposure, limit exploitation possibilities, and protect systems while preparing and validating a definitive solution.
These measures may include network segmentation, access and communication restrictions, enhanced monitoring, and specific mechanisms to block certain attack vectors. Depending on the context, protection controls that mitigate vulnerability exploitation without directly modifying the affected software may also be used.
No measure is universal or automatically replaces the definitive fix. Its effectiveness depends on the vulnerability, the affected asset, its function, and potential operational consequences. In healthcare settings, any intervention must be carefully evaluated to avoid the mitigation introducing additional risks to the functionality of medical devices or care continuity.
The goal is not to apply a specific technology but to reduce risk as soon as possible, proportionately and safely, while working on a definitive solution.
Hospital cybersecurity is no longer an exclusively technological issue. In a hospital, an IT incident can delay a procedure, interrupt a diagnostic test, block medication dispensing, or hinder access to essential clinical information for decision-making. Therefore, protecting healthcare systems is not just about preserving data: it means maintaining the ability to care for patients safely and continuously.
This is not a problem exclusive to any particular healthcare system. Hospitals worldwide face similar challenges: increasingly connected infrastructures, legacy systems that are difficult to update, medical devices with long life cycles, growing reliance on external providers, and adversaries evolving at the pace of new technologies.
What varies between countries and organizations is their level of maturity, their resources, their governance models, and their response capacity. The risk, however, is shared.
From WannaCry to Hospital Clínic: when the incident reaches the patient
In May 2017, the WannaCry ransomware attack affected numerous organizations in the British healthcare system, including the NHS. The system disruption forced the cancellation of appointments and procedures and highlighted an uncomfortable reality: technology unavailability can directly translate to healthcare activity.
Six years later, in March 2023, the cyberattack on Hospital Clínic in Barcelona again demonstrated this connection. The incident affected hospital services and related centers, forcing the suspension or rescheduling of consultations, tests, and treatments, while prioritizing the continuity of essential services. Subsequently, data stolen during the attack was also published.
Both cases show that the severity of a healthcare incident cannot be measured solely by the number of affected devices, exposed records, or recovery costs. The consequences on clinical activity, professionals, and patients must also be considered.
In healthcare, recovery time matters, but so does which services become unavailable, for how long, and what alternatives exist to maintain care.
The fundamental question, therefore, is not only whether a hospital can suffer a cyberattack. It is whether it can continue providing safe care when its systems stop functioning as they should.
Healthcare data: the impact of a breach beyond the incident
Data protection is the other major dimension of the problem. Healthcare information is especially sensitive because it describes intimate aspects of individuals and can generate consequences that persist long after an incident has been technically resolved.
The attack on Medibank, one of Australia’s main private health insurance providers, in 2022, exposed information of approximately 9.7 million customers. Some of the stolen data ended up being published, including personal and health details.
This type of incident demonstrates that the risk does not end when systems are recovered. The exposure of medical information can facilitate fraud, extortion, and impersonation, in addition to causing personal and reputational damage that is difficult to repair.
The evolution of ransomware has also changed the scenario. Attackers no longer need to limit themselves to encrypting systems and demanding a ransom to restore availability. They can steal information and threaten to disclose it, pressuring the organization even if it has backups and manages to restore its services.
Therefore, a healthcare strategy must simultaneously protect system availability, data confidentiality, and the integrity of clinical information. None of these dimensions can be addressed in isolation.
A hospital is much more than a computer network
The complexity of the healthcare environment explains part of its exposure.
A hospital’s infrastructure combines traditional corporate systems—identity, email, administrative applications, and databases—with clinical applications, laboratory systems, imaging diagnostic equipment, monitoring devices, and connected medical technologies.
This convergence between IT, IoT, and IoMT (Internet of Medical Things) expands the attack surface and multiplies dependencies. A connected device can become an entry point, a compromised system can facilitate movement to other segments, and an incident in a provider can affect services the hospital considers critical.
Moreover, not all assets can be managed like a conventional computer.
A medical device may have a lifespan of many years and depend on certified software, manufacturer-validated configurations, or very limited maintenance windows. An apparently simple update may require prior testing, coordination with the provider, and guarantees that it will not affect its clinical operation.
In certain cases, shutting down, restarting, or modifying equipment is not an immediate option.
This introduces an essential difficulty: the organization may know of a vulnerability and yet not be in a position to immediately install the definitive fix.
Therefore, it is not enough to have an inventory of vulnerabilities and a patching schedule. It is necessary to understand which assets are truly critical, how they connect to each other, what exposure they present, and what measures can reduce risk while preparing a definitive solution.
Dependence on the ecosystem: the risk doesn’t end at the hospital doors
Healthcare also depends on a technological and operational ecosystem that includes software providers, cloud services, manufacturers, insurers, laboratories, payment platforms, and process management companies.
The attack on Change Healthcare in the United States in February 2024 illustrated the impact of this interdependence. The disruption of a central platform for managing healthcare transactions affected processes such as claims processing, payments, and prescription management, with consequences extending far beyond the directly attacked organization.
The lesson is clear: an entity can have reasonably robust security controls and still be exposed to a disruption originating from a third party on which it depends.
Risk management must therefore consider not only its own assets but also technological and operational dependencies, service concentration, provider access, and alternative procedures to maintain activity.
Healthcare resilience requires knowing what happens if an external service becomes unavailable and how long the hospital can operate without it.
Artificial intelligence accelerates the challenge
Artificial intelligence is transforming both defensive capabilities and attackers’ possibilities. It can help analyze large volumes of information, identify patterns, automate tasks, and reduce the time needed to discover and exploit weaknesses.
Data published by Google Threat Intelligence Group in September 2026 points to an evolution that deserves attention. The number of vulnerabilities disclosed monthly rose from 5,045 in January to 10,740 in August of that year. The monthly average of vulnerabilities observed as exploited went from 10.5 in 2025 to 18 between January and August 2026.
These figures require context: more vulnerabilities being disclosed does not mean all are exploitable or represent the same risk. In fact, only a small proportion of disclosed vulnerabilities were observed in active exploitation. However, the trend reinforces a relevant concern: defenders need to identify and reduce exposure more quickly, especially when a vulnerability affects a critical asset and there is evidence it is being used by attackers.
AI also opens the door to new forms of automation through agents capable of executing tasks and utilizing tools. An agent is not simply an assistant that answers questions: depending on its permissions, it can interact with systems, query resources, and perform actions.
In September 2026, an incident in Australia highlighted the risks associated with the use of artificial intelligence agents. One of these agents accessed unauthorized public and non-public files from a Medicare statistics portal. Authorities indicated there was no evidence of access to patient personal data or a broader compromise of the healthcare network.
It is important to maintain that distinction: the case does not demonstrate access to medical records, but it does illustrate why new automated capabilities require clear limits, access controls, and oversight mechanisms.
The question is no longer solely how to protect systems against conventional attacks. We must also ask how to control the agents operating on them, what permissions they need, what information they can access, and how to verify the actions they perform.
The Defender’s Window: buying time when we can’t patch immediately
In the face of this acceleration, defenders need to take advantage of a window of opportunity: the time between identifying a weakness and its possible exploitation, or between detecting a threat and applying an effective mitigation.
Greg Brockman, president and co-founder of OpenAI, has contributed to the debate on the defender’s window of opportunity against the acceleration of artificial intelligence capabilities: The Defender’s Window. The idea is especially relevant for critical sectors like healthcare, where the speed at which threats evolve contrasts with the difficulty of modifying certain systems without affecting care continuity.
In a hospital, we cannot always immediately fix a vulnerability. But we cannot afford to wait to reduce the risk it represents.
Here, compensatory measures become particularly important. When an update cannot be applied immediately, organizations must evaluate alternatives that temporarily reduce exposure, limit exploitation possibilities, and protect systems while preparing and validating a definitive solution.
These measures may include network segmentation, access and communication restrictions, enhanced monitoring, and specific mechanisms to block certain attack vectors. Depending on the context, protection controls that mitigate vulnerability exploitation without directly modifying the affected software may also be used.
No measure is universal or automatically replaces the definitive fix. Its effectiveness depends on the vulnerability, the affected asset, its function, and potential operational consequences. In healthcare settings, any intervention must be carefully evaluated to avoid the mitigation introducing additional risks to the functionality of medical devices or care continuity.
The goal is not to apply a specific technology but to reduce risk as soon as possible, proportionately and safely, while working on a definitive solution.
Become a premium member for free!
——————————————————-
Click Here For The Original Source.
