Change Healthcare: The Defining Incident

ALPHV/BlackCat struck UnitedHealth's claims-clearing subsidiary, exfiltrating 190M individuals' PHI and ~6 TB of data — the largest healthcare breach on record. A ~$22M ransom was paid; RansomHub re-extorted the same data. Total impact exceeded $2.45B. Because Change Healthcare processes a large share of U.S. medical claims, a single intrusion disrupted pharmacy and provider payments nationwide.

Interlock, Medusa & Anubis: Industrial-Scale Ransomware

Interlock — 5 appearances — hit DaVita (~2.7M records, ~1.5 TB stolen), Kettering Health (system-wide outage, 14 centers), and Brockton and Legacy community health orgs. Medusa (Spearwing) claimed 40+ victims in early 2025 with demands of $100K–$15M. Anubis combined encryption with file destruction, making data recovery impossible even after ransom payment.

Supply-Chain Blast Radius

BPO provider Conduent disclosed 15.5M (TX) and 10.5M (OR) individuals affected. Episource lost 5.4M records including downstream client Sharp Healthcare. TriZetto (Cognizant) exposed 3.4M; Oracle Health saw EHR data stolen from multiple hospitals. Ascension was breached via Black Basta (~5.6M) and a former business partner — illustrating how risk extends beyond an org's own walls.

Perimeter & Credential Theft

Internet-facing Fortinet, Ivanti, Citrix, and Palo Alto appliances were the dominant initial-access vector. CVE-2024-55591 (Fortinet auth-bypass) was the single most-referenced CVE. RMM tools (SimpleHelp, AnyDesk, MeshAgent) were repeatedly abused for hands-on-keyboard access. Information stealers — Lumma, StealC, Rhadamanthys — accounted for 24% of malware and harvested the credentials seeding later intrusions.

Medical IoT & Unmanaged Devices

7 of 37 CVEs targeted cameras, DVRs, and embedded firmware. CISA flagged a Contec CMS8000 patient monitor backdoor beaconing to a China-linked IP. Hikvision devices (4 CVEs) were among the most-exploited products — a perimeter problem compounded by unmanaged devices sitting deep in clinical environments.

Emerging Signals: Nation-State & SEC Materiality

Lazarus Group's adoption of Medusa RaaS marked a convergence of nation-state tradecraft with criminal ransomware infrastructure. The FBI warned of social-engineering campaigns impersonating fraud investigators. West Pharmaceutical's breach was declared "material" in an SEC filing. Sinobi went from unknown to 54 claimed healthcare victims in early 2026.

Prioritise Edge & Perimeter Patching

12 of 37 CVEs hit VPNs, firewalls, and gateways (Fortinet, Ivanti, Citrix, Palo Alto). Patch internet-facing appliances on an emergency cadence and retire EOL devices. CVE-2024-55591 is the most-referenced entry point into healthcare networks.

Govern RMM and Third-Party Access

Breaches trace repeatedly to business associates and RMM tooling (SimpleHelp, AnyDesk, MeshAgent). Inventory RMM tools, enforce allow-listing and phishing-resistant MFA, and contractually mandate breach SLAs from vendors handling PHI.

Harden Against Double-Extortion Ransomware

Interlock, Medusa, and Anubis exfiltrate before encrypting. Maintain offline immutable backups, segment clinical networks, and rehearse downtime procedures. Anubis also destroys files — backups are non-negotiable.

Defend Medical IoT and Devices

7 of 37 CVEs affect cameras, DVRs, and firmware (Hikvision, Dahua, Contec). Place medical/IoT devices on isolated VLANs, monitor egress for anomalous beaconing, and validate firmware integrity regularly.

Counter the Supply-Chain Blast Radius

Single vendor compromises (Change Healthcare, Conduent, Episource, TriZetto) cascaded to tens of millions. Map fourth-party dependencies, require SBOMs from critical SaaS and BPO providers, and treat your supply chain as an extension of your own attack surface.