Ransomware surges and device wipes
Ransomware attacks against the healthcare industry rose 40 percent in the third quarter of 2026 compared to the second quarter. This volume more than doubled when measured against the same period last year. The United States recorded 185 confirmed attacks in that third quarter alone. On March 11, 2026, the Handala group targeted Stryker Corporation by compromising Microsoft Intune credentials to issue a remote wipe command to 200,000 devices. Zscaler reported a 275.8 percent increase in exfiltrated data between April 2025 and March 2026. The Stryker incident shows how credential theft leads to mass device failure. This theft often precedes extortion. The Change Healthcare breach in February 2024 impacted 190 million people. UnitedHealth paid a $22 million ransom to regain access to its systems. Among Medicare patients already admitted to a hospital when a ransomware attack begins, in-hospital mortality increases by 34% to 38%. A single day of ransomware downtime costs the average US healthcare organization about $1.9 million. The Unimed breach in Germany affected 135,000 individuals, while Japan’s Nippon Medical School Musashi Kosugi Hospital reported a massive breach affecting 131,700 people after the NetRunner group issued a $100 million ransom demand. Caribbean Medical Center in Puerto Rico saw 92,000 individuals affected by The Gentlemen. In the United States, Mt. Spokane Pediatrics experienced a LockBit attack affecting 32,021 people. The US remains the most heavily targeted country, accounting for 225 of the 410 attacks against healthcare providers and businesses in the first half of 2026. Qilin was the most active group against direct care providers, while DragonForce led attacks against healthcare businesses.
Mandatory technical safeguards
The 2026 HIPAA Security Rule removes the distinction between addressable and required safeguards. Regulators demand technical enforcement rather than documented intent. You must implement these specific controls to avoid enforcement actions from the Office for Civil Rights.
| Safeguard Type | Requirement |
|---|---|
| Authentication | Multi-factor authentication (MFA) everywhere |
| Data Protection | Encryption at rest and in transit |
| Vulnerability Management | Biannual scanning and annual penetration testing |
| Recovery Time | 72-hour data restoration capability |
Small practices cannot use software limitations to delay MFA deployment. Organization size is no longer a mitigating factor. Organizations must maintain complete asset inventories and network maps showing PHI flow. Documentation without implementation fails audits. Organizations must also adhere to 48-hour recovery point objectives and 15-day critical patch cycles. Verification of vendor technical safeguards must happen annually through written documentation. HIPAA mandates that covered entities notify individuals and the HHS Secretary of breaches within 60 days. Compliance also includes 24-hour cross-entity notification timelines and one-hour workforce access termination. Most organizations encrypt data in transit, but the 2026 rules make encryption for databases, file systems, backups, and powered-off storage mandatory. The 72-hour data restoration requirement follows HHS ransomware guidance emphasizing recovery capability as a core security function.
Convergence of design and enforcement
CISA’s Secure by Design pledge urges manufacturers to integrate security during the development phase. This initiative targets seven goals including the elimination of default passwords and the reduction of vulnerability classes. These goals mirror the mandatory requirements the HIPAA overhaul imposes on healthcare entities. For example, CISA pushes for timely security patches while HIPAA requires strict patch management cycles. Since the final rule arrived, covered entities have 180 days to comply. Will manufacturers prioritize these security investments before the enforcement window closes? The CISA initiative includes 68 technology companies like Microsoft and IBM. It focuses on establishing vulnerability disclosure policies and improving evidence of intrusions. This aligns with the HIPAA requirement for annual compliance audits and annual penetration testing. Manufacturers must also ensure transparency in vulnerability reporting and implement MFA to enhance security layers.
