Healthcare Cyberattacks Aren’t Falling Fast Enough, SonicWall Warns

Cyberattack volumes are easing across several industries, but healthcare isn’t getting the same break. A new report from cybersecurity firm SonicWall found that healthcare recorded the smallest year-over-year decline in attacks among the sectors it tracks, a sign that the industry’s core weak spots are still firmly in place. For hospitals, clinics, and connected-care organizations, the question is no longer just whether attacks happen, but whether systems can keep care moving when they do. Healthcare’s operational architecture, the report suggests, still leaves persistent entry points wide open.

What Did SonicWall Find About Healthcare Cyberattacks?

SonicWall’s 2026 Healthcare Protect Brief shows a troubling gap between healthcare and other major industries. While most sectors saw attack volumes drop between 23% and 56% year over year, healthcare’s decline was only 17%. The data, pulled from SonicWall’s global network of more than one million security sensors, suggests attackers aren’t walking away from healthcare. The industry stays a focal point because of the high value of its data and the extreme pressure to restore services fast after an incident, both of which make it a magnet for ransomware actors.

The report also notes that healthcare has more active ransomware families than any other tracked vertical, which cements its status as a high-stakes target for cyber extortion. That kind of pressure shows why small, incremental security tweaks may not be enough to deter attackers who understand the sector’s specific weaknesses. The findings point to structural problems that call for a more fundamental shift in strategy.

Why Is Healthcare Still So Attractive to Attackers?

So why does healthcare keep getting hit? The answer is a mix of factors that make it both lucrative and accessible. For 13 consecutive years, the industry has reported the highest average data breach cost, reaching $10.93 million in 2023, according to IBM. That figure reflects more than regulatory fines; it also captures extensive cleanup and reputational damage. The data itself, a rich blend of personal, medical, and financial information, commands real value on the dark web.

Beyond data value, operational urgency is a key weakness. Hospitals and clinics can’t tolerate prolonged downtime because it directly affects patient safety and care delivery. That pressure to restore systems quickly often makes them more likely to pay ransoms. In 2023, data breaches affected a staggering 133 million individuals, more than double the year before, according to HIPAA Journal. Add a tangle of modern and legacy systems plus a wide array of third-party vendors and devices, and you get a sprawling attack surface that’s tough to defend across the board.

Why Are Remote Desktop Tools Such a Persistent Weak Spot?

Remote desktop tools like Microsoft’s Remote Desktop Protocol (RDP) and Virtual Network Computing (VNC) are essential to modern healthcare. They enable IT teams, third-party vendors, and remote clinicians to access systems for support, management, and telehealth. That convenience comes with real risk, though. SonicWall flagged these tools as a primary structural problem, logging 13.3 million exploitation attempts against the UltraVNC platform alone in the first five months of 2026. As the HIPAA Journal put it, when these tools aren’t properly secured, they become a front door for attackers.

The root cause is often misconfiguration. A remote desktop portal exposed straight to the internet and guarded only by a weak password is an easy mark. Once an attacker steals working credentials, they gain a direct, interactive foothold inside the network, frequently with elevated privileges. From there they can move laterally, deploy ransomware, and exfiltrate data. Operational inertia makes it worse: legacy remote access setups stick around because replacing them looks disruptive to clinical workflows.

Four reasons remote desktop tools keep creating risk

These four factors explain why the same access paths keep showing up in breach reports:

1. They are often exposed for convenience. Distributed care models and the need for immediate vendor support can push IT teams to leave access paths open to the internet without enough controls.
2. They concentrate privilege. A successful login gives an attacker direct system interaction and control, far more than limited application-level access would allow.
3. They lean on strong identity controls. Without multi-factor authentication (MFA), a single compromised password can lead to a full network breach by bypassing perimeter defenses.
4. They are easy to overlook operationally. Legacy remote administration tools may stay in place for years because they’re baked into workflows and swapping them out seems too complex or disruptive to patient care schedules.

What Makes Connected Medical Devices and IoT So Hard to Defend?

The rapid adoption of the Internet of Things in healthcare has opened a new frontier of risk. SonicWall identified 243 unique attack signatures targeting connected medical devices, a clear marker of the growing threat to this equipment. Healthcare IoT runs the gamut, from infusion pumps and patient monitors to large-scale imaging systems and robotic surgical tools. The global IoT in healthcare market is forecasted to top $1 trillion by 2032, dramatically expanding the attack surface. A compromised device doesn’t just risk a data breach; it can disrupt diagnostics, treatment, and patient monitoring, posing a direct threat to patient safety.

Why patching is harder in care environments

Unlike standard IT equipment, medical devices carry their own security headaches. Many run older operating systems that vendors no longer support and can’t easily patch. Taking a device offline for updates requires careful coordination with clinical staff to avoid disrupting care, and maintenance windows are often slim. On top of that, any software update may need vendor approval or even regulatory recertification, a process that can be slow and expensive.

Why visibility is often incomplete

Many health systems lack a complete, real-time inventory of every connected device on their network. Devices get moved between departments, connected by different teams such as biomedical and IT, and managed through separate systems. Without centralized visibility, security teams can’t be sure that every device is properly configured, patched, and monitored, leaving unmanaged devices as potential entry points.

Are Legacy VPNs Still the Wrong Fit for Modern Healthcare Access?

Traditional Virtual Private Networks (VPNs) were built for a different era, one in which users connected to a central corporate network to access resources. That is a poor fit for today’s distributed healthcare ecosystem. With the rise of telehealth, used by 79% of U.S. hospitals according to OTTEHR, and the steady need for remote vendor support, the old “connect, and you’re on the network” approach creates real exposure. Once a user authenticates via a legacy VPN, they can typically access a wide range of network resources, making it easier for an attacker with stolen credentials to move laterally.

Security experts now point toward a zero-trust architecture instead. The model runs on a simple principle: never trust, always verify. Rather than granting broad network access, zero trust verifies identity and device posture for every request and opens only the specific application or data needed for the task at hand. That approach sharply limits the damage a compromised account can do, since the attacker is confined to a single application rather than roaming the entire network.

What Should Health Systems, Clinics, and Care Organizations Do Next?

The SonicWall report reads less like a message of defeat and more like a call for a smarter, architecturally sound approach to security. Organizations can take several practical steps to build resilience without disrupting care. Start by closing the obvious entry points: restrict all internet-exposed remote desktop tools and enforce MFA on every remote access session, no exceptions. Network segmentation matters too, since it prevents an attacker who breaches one area, such as guest Wi-Fi or an administrative system, from reaching critical clinical systems and connected devices.

Building a complete inventory of connected devices is the groundwork for securing them. Once you know what’s on your network, you can prioritize patching based on vulnerability severity and clinical impact. Over time, plan to replace broad legacy VPN access with more granular, application-level controls aligned with zero-trust principles. And technology alone won’t carry the load. Regularly testing backup, disaster recovery, and manual downtime procedures helps keep clinical operations running even during a major incident. As many organizations are learning, these fixes work best when security, backup, disaster recovery, network management, endpoint protection, and incident coordination are handled together as part of a coordinated healthcare IT services strategy rather than a string of isolated point solutions.

Why Cyber Resilience in Healthcare Is Now an Operations Issue, Not Just an IT Issue

The rising frequency and impact of cyberattacks have turned cybersecurity from a technical problem into a core operational concern. A ransomware attack is no longer just an IT headache; it disrupts patient scheduling, delays diagnostic procedures, affects medication administration, and halts revenue cycle operations. Recent incidents show that exposure runs across the entire ecosystem, from large hospital systems to specialty clinics to third-party technology vendors. The point is gaining traction at the policy level, too, with federal agencies such as the Centers for Medicare & Medicaid Services exploring new rules to bolster provider resilience, as discussed by FDD.

This shift demands a change in mindset. The goal isn’t only prevention, which is no longer guaranteed, but resilience: the ability to keep care moving during and after a cyber event. That means downtime plans should be as well rehearsed as clinical emergency drills, and incident response teams should include clinical and operational leaders, not just IT staff. The organizations that thrive will be those that design architectures and processes for disruption, rather than assuming disruption can always be dodged.

The Real Warning in SonicWall’s Numbers

The most important takeaway from SonicWall’s report is the reason behind the numbers: healthcare cyberattacks aren’t falling fast enough because the sector still leans on access models, device fleets, and operational workarounds that attackers have learned to exploit. A 17% decline in attack volume rings hollow next to the much steeper drops in other industries.

The persistent targeting of remote desktop tools, the expanding and hard-to-defend footprint of connected medical devices, and the architectural flaws of legacy VPNs remain the industry’s primary pressure points. Fixing them takes more than new security products; it takes a strategic alignment of technology, processes, and people. The organizations most likely to improve their resilience will be those that treat cybersecurity as part of clinical operations, uptime planning, and patient safety, not a box to check off to the side.