Attackers succeed in 95% of Healthcare incidents ASD responds to.
Health service providers notified more data breaches to the OAIC in 2025 than any other sector, and ransomware incidents against Australian healthcare doubled year-on-year. Over 80% of stolen US health records were taken from third-party vendors and software services — not from hospitals themselves.
Why Healthcare is in the crosshairs
Five shifts shaping the healthcare threat environment — drawn from ASD, OAIC, FBI, AHA, Sophos, and Verizon reporting.
Most-targeted in the US, most-notified in Australia — and attackers usually succeed
The FBI's 2025 Internet Crime Report puts healthcare and public health first among US critical infrastructure sectors for ransomware and data-breach complaints; OAIC data puts health service providers first for notifiable data breaches in Australia; and ASD reports attackers succeeded in 95% of the healthcare incidents the ACSC responded to in FY2024–25, against 52% across all sectors.
The third-party dependency problem is acute
The AHA's finding that more than 80% of stolen US PHI came from vendors — not hospitals — reframes the defensive picture. A hospital can have strong internal controls and still be exposed by a pathology provider (Synnovis), a claims processor (Change Healthcare), an e-prescription service (MediSecure), or an imaging vendor. Verizon's 2026 DBIR found a third party involved in 48% of breaches, up 60% on the previous year.
Downtime is a life-safety issue
AHA's John Riggi describes ransomware targeting of healthcare as "threat-to-life crime". Hospitals face maximum pressure to pay because operational downtime has immediate patient-safety consequences. King's College Hospital NHS Foundation Trust found the 2024 Synnovis/NHS London attack was a contributing factor in a patient's death, and the 2020 Düsseldorf University Hospital attack forced patient diversions during life-threatening emergencies.
The attack surface keeps expanding
Electronic health records, Internet of Medical Things devices, telehealth platforms, patient portals, genomic databases, and aged care sensor networks have all been added to the attack surface. Medical device refresh cycles are slow — so Verizon's 2026 finding that vulnerability exploitation is now the top way into breaches, at 31%, applies with particular force in healthcare.
Paying is declining — but validation is the next step
Sophos' 2025 data shows ransom payment in healthcare has dropped from 61% in 2022 to 36% in 2025, and recovery costs (excluding any ransom) have fallen 60%. The sector is investing in backups, segmentation, and response preparation. The next step is continuous validation that those investments actually hold under current attacker tradecraft.
What regulators and experts are saying
The Change Healthcare cyberattack is the most significant and consequential incident of its kind against the U.S. healthcare system in history.
The vast majority are perpetrated by foreign ransomware gangs, primarily Russian-speaking groups, which specifically target health care hoping for a big payout. They know these attacks cause disruptions and delays to digitally dependent health care delivery, posing a risk to patient and community safety… These despicable acts are in fact threat-to-life crimes.
Time is of the essence with data breaches as the risk of serious harm often increases as days pass. Timely notification ensures people are informed and can take steps to protect themselves.
Healthcare is a SOCI Act critical infrastructure sector
Hospitals with a general intensive care unit are critical hospitals under the SOCI Act, with registration and cyber incident reporting obligations; designated hospitals must also maintain a risk management program. Ransomware payment reporting is mandatory under the Cyber Security Act 2024 for businesses over $3M turnover and SOCI responsible entities.
Hospitals with a general intensive care unit are critical hospitals under the SOCI Act: they must register the asset, report cyber incidents and notify third-party data storage or processing providers. Hospitals listed as designated hospitals in Schedule 1 of the CIRMP Rules must also maintain a CIRMP addressing four hazard vectors: cyber and information security, personnel, supply chain, and physical security and natural hazards. For the cyber hazard vector, the CIRMP must adopt one of five named frameworks or an equivalent. Healthcare entities also face obligations under the Privacy Act 1988 (including the Notifiable Data Breaches scheme), the My Health Records Act 2012 for organisations connecting to My Health Record, and the National Safety and Quality Health Service (NSQHS) Standards. Healthcare entities outside SOCI may still adopt the Essential Eight voluntarily as a baseline.
LegislationFederal legislation that includes health care and medical among its critical infrastructure sectors. Critical hospitals (those with a general intensive care unit) must register and report cyber incidents; hospitals listed as designated hospitals in the CIRMP Rules must also maintain a CIRMP addressing four hazard vectors: cyber, personnel, supply chain, and physical security and natural hazards. NodeZero produces attack-based evidence for the cyber hazard vector across clinical and administrative networks, and segmentation testing shows whether boundaries to supplier-connected networks hold. For the cyber vector, entities must adopt one of five named frameworks or an equivalent.
Prescriptive and technically focused. Eight specific mitigation strategies with clear pass/fail controls. Common for government-adjacent entities, defence industry, and smaller organisations adopting ASD guidance.
Where NodeZero appliesBroad lifecycle coverage from governance through recovery without mandating specific technologies. Suited to entities operating across jurisdictions or mapping existing controls into a flexible structure.
Where NodeZero appliesInternational management system standard with formal certification. Chosen by larger entities with mature security programs, international operations, or existing ISO certification investment.
Where NodeZero appliesMaturity model assessing organisational capability across 10 domains. Originally built for the US electricity sector. Process and governance oriented -- less about specific controls, more about repeatable capability.
Where NodeZero appliesSector-specific to energy. Derived from C2M2 and NIST CSF with Australian privacy additions. Managed by AEMO. The default for electricity and gas market participants with OT/ICS environments.
Where NodeZero applies
Healthcare providers handle highly sensitive patient information. The Privacy Act and Australian Privacy Principles impose strict obligations on health records.
Where NodeZero applies
Applies to hospitals and health services that process patient billing and payment card transactions.
Where NodeZero applies
Relevant for health technology providers and digital health platforms that manage patient data on behalf of healthcare organisations.
Where NodeZero applies
Mandatory 72-hour ransomware payment reporting for businesses with annual turnover over $3M and for SOCI responsible entities, including critical hospitals.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
Cyber Security Act 2024
30 May 2025Mandatory reporting of ransomware payments within 72 hours for businesses over $3M turnover and SOCI responsible entities. Healthcare organisations are prime ransomware targets — clinical systems cannot wait weeks for recovery. NodeZero surfaces the attack paths ransomware operators use — credential abuse, lateral movement, privilege escalation — so they can be closed.
Privacy Act statutory tort
10 Jun 2025Private right of action for serious invasions of privacy that are intentional or reckless. Healthcare organisations hold highly sensitive personal information — clinical history, Medicare records, mental health data — and a breach still brings regulatory exposure under the Privacy Act.
SOCI Act — Healthcare critical infrastructure
In effectHospitals with a general intensive care unit are critical hospitals: registration, mandatory cyber incident reporting to ASD (12 hours for significant impact, 72 hours for relevant impact), and a risk management program for hospitals designated in the CIRMP Rules.
Strengthened Aged Care Quality Standards
1 Nov 2025The strengthened standards, in force from 1 November 2025, expect providers to manage cyber security risks to their information management system as part of risk management (Outcome 2.4).
Find your organisation
See how the changes affect you specifically
Public hospital networks
State and territory hospital networks managing clinical environments across many facilities; hospitals with a general intensive care unit carry SOCI Act obligations.
View details →Private hospital groups
Private hospital operators face revenue exposure when ransomware cancels elective surgery, insurer scrutiny of security controls, and Notifiable Data Breaches obligations under the Privacy Act.
View details →Aged care facilities
Aged care providers hold sensitive health information and rely on systems for medication and care. The Strengthened Aged Care Quality Standards expect cyber security risks to be managed.
View details →Why security teams trust NodeZero
Prove your healthcare security posture before the next assessment
See NodeZero run in your own environment, and how its findings line up with SOCI Act and Privacy Act obligations