Cyberattacks on healthcare organizations are continuing to rise, are becoming costlier to resolve, and are increasingly negatively impacting patient care, according to a recent survey conducted on behalf of the cybersecurity firm Proofpoint. The findings were published in the 2026 Ponemon Healthcare Cybersecurity Report.

The survey was conducted by the Ponemon Institute and included 705 responses from IT and IT security practitioners whose responsibilities include setting cybersecurity policies, selecting vendors and contractors, and managing security budgets. The respondents included public healthcare providers (22%), private healthcare providers (18%), healthcare insurers (18%), payers (11%), healthcare insurance companies (10%), with the remainder from life sciences, pharma, and biotechnology companies.

According to the survey, 97% of organizations experienced at least one cyberattack in the past 12 months, with an average of 51 attacks per organization, up from 43 attacks this time last year. In 74% of incidents, the incidents had a negative impact on patient care. The report was focused on four categories of cyberattack: cloud/account compromises, business email compromise, ransomware attacks, and supply chain attacks. Supply chain attacks had the greatest impact on patient care, with 90% of respondents affected by a supply chain attack reporting that it impacted patient care, followed by ransomware attacks (72%), business email compromise incidents (69%), and cloud/account compromises (65%).

Sixty-eight percent of respondents said business email compromise attacks resulted in delays to procedures and tests, 70% of respondents said ransomware attacks resulted in longer patient stays, 59% of respondents said cloud/account compromises resulted in an increase in complications from medical procedures, and 35% of respondents said supply chain attacks resulted in an increased mortality rate.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

These attacks are costly for healthcare organizations. Respondents were asked about the cost of the most expensive cyberattack at their organization in the past 12 months. The average cost of the most expensive attack was $4.2 million, up from $3.9 million in 2025. The most expensive element was disruption to business operations, which cost an average of $1.39 million per incident, up from $1.2 million in 2025.

The survey revealed that healthcare organizations are embracing AI tools, with 45% of respondents confirming that they have embedded AI, 24% in cybersecurity operations and 21% in cybersecurity and patient care; however, utilization often exceeds the ability to govern and secure those tools and platforms. Sixty percent of respondents said that they lacked sufficient controls governing the sensitive data used in AI systems, and while security measures had been implemented, 42% said those measures had not been developed for use with AI platforms. Only one-third (32%) of respondents said they have full visibility into the usage of AI tools within their organization. The biggest perceived AI-specific risks were supply chain risk from AI vendors (40%), data leakage through prompts (36%), AI-generated phishing/social engineering attempts (34%), and malicious or biased outputs that affect care decisions (32%).

While hacking incidents continue to increase, insider risk continues to be a problem in healthcare, with 97% of organizations experiencing at least two data loss or exfiltration incidents in the past 12 months, with an average of 21 incidents at each organization. More than half of respondents (54%) said these incidents impacted patient care, and 56% of respondents said these insider incidents resulted in an increase in mortality rates.

“Cybersecurity incidents are increasingly disrupting clinical operations, consuming organizational resources, and affecting care delivery,” explained Proofpoint.  “The healthcare organizations that will be most successful in the years ahead will be those that combine cyber resilience, identity security, human risk management, supply chain security, and AI governance into a unified strategy focused on protecting both operations and patient outcomes.”

The post Healthcare Cyberattacks Increasing and Having Greater Impact on Patient Care appeared first on The HIPAA Journal.

The tactics of ransomware groups are constantly changing to increase pressure on victims to give in to their demands. Initially, file encryption alone was sufficient; however, as victims improved cyber resilience and were able to recover their encrypted files from backups, tactics had to evolve. Ransomware groups incorporated data theft into their attacks and started threatening to sell or leak the stolen data if the ransom was paid. This double extortion approach proved highly successful, with the threat of a data leak alone sufficient to prompt many victims to pay up.

Encryption and data leak threats are no longer enough, as the percentage of victims paying ransoms continues to fall. According to a recent survey commissioned by the Identity Threat Detection and Response (ITDR) firm Semperis, the percentage of ransomware victims paying ransoms has fallen from 78% in 2024 to 69% in 2025, and 59% in 2026.

Ransomware groups have responded by adopting more aggressive tactics, and a trend has emerged of ransomware groups issuing personal threats against company employees and their friends and family members. The survey revealed that 37% of ransomware attacks involved threats against friends or family members of staff members, and 41% of respondents to the survey said they had been a target of physical or psychological intimidation.

While contacting individuals whose data was stolen in an attack has been adopted by several groups in the past, the threats have generally been limited to the publication of personal data, but threats are becoming more severe. Ransomware groups are now issuing threats of physical violence and are contacting employees and their friends and family members via text, email, or phone, confirming that they know where they live, work, and even where their children go to school.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The threat of data erasure, destruction, and publication remains the most common tactic (56%), followed by blackmail/extortion (41%), and system lockouts or sabotage (40%); however, 23% of malicious actors have resorted to psychological intimidation, 17% are issuing physical threats, and in 10% of cases, have threatened legal exposure. Semperis warns in its third annual ransomware report that personal threats are gaining more traction. Out of the individuals who received personal threats, 57% received threatening texts, letters, or packages, 37% received threats about friends and family members, 19% were threatened with physical intrusion, 17% with abduction, 13% with bodily harm, and 6% with stalking.

Semperis said that in 53% of cases, the attackers followed through on their threats. There have been cases of doxxing – exposing personal information – and swatting – triggering an armed police response to a reported threat – which can push victims into ransom negotiations. About 25% of victims reported doxxing, and 23% experienced swatting, according to the survey.

The impact on the individuals concerned has been severe, with around a quarter of the targeted individuals requiring medical or mental health care, and 14% stating they have been forced to change jobs, offices, or homes as a result. Semperis suggests that companies need to respond to these modern threat tactics and should incorporate procedures into their ransomware resilience strategies, including how to respond to attacks involving threats to individuals outside of the organization.

“I’ve spoken with CISOs that had strong relationships with law enforcement,” said Courtney Guss, AVP of Crisis Management, Semperis. “They’ve found it to be a much faster route to information and resources than they would otherwise have found on their own, which can often help them recover more quickly. So, knowing those contacts and building those relationships in advance should be part of your crisis management plan.” Semperis also recommends strengthening identity resilience, preparing for identity system breaches, and practicing incident response procedures time and again against realistic scenarios, including tabletop exercises involving all team members involved in the ransomware response.

The post Ransomware Groups Increasingly Resorting to Real World Threats appeared first on The HIPAA Journal.

A high-severity authentication bypass vulnerability has been identified in the Ivanti Connect Secure (Pulse Connect Secure) enterprise-grade SSL VPN that can allow a remote, unauthenticated malicious actor to execute arbitrary commands, steal credentials, and exfiltrate sensitive data.

Researchers at the cybersecurity firm Volexity identified in-the-wild exploitation of a vulnerability chain involving the authentication bypass vulnerability in the first week of October. The threat actor was able to compromise a fully patched ICS VPN appliance and achieve remote, root-level code execution. The vulnerability has been exploited by malicious actors on limited ICS customers and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog.

Volexity determined that the threat actor exploited three zero-day vulnerabilities in the attack, including the authentication bypass vulnerability and a remote code execution vulnerability, which are jointly tracked as CVE-2026-104935. The vulnerability has a CVSS v3.1 base score of 8.6. Ivanti says the vulnerability has been exploited by malicious actors onlimited ICS customers, and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog. The third zero-day is a privilege escalation vulnerability, which has yet to be patched. Ivanti is working on a patch to fix that flaw, which will be addressed in a future release.

The CVE-2026-104935 vulnerability affects the following Ivanti Connect Secure (ICS) versions, and patches have been released to fix the flaws. Customers are also advised to run the Integrity Checker Tool regularly.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Limited indicators of compromise have been identified by Volexity and are detailed in its blog post.

The post Ivanti Connect Secure Zero Day Exploited in Attacks appeared first on The HIPAA Journal.

An analysis of medical devices indicates that healthcare organizations face a significant risk of future quantum-enabled attacks, as only a small percentage are capable of supporting a transition to post-quantum cryptography (PQC). The analysis was conducted by cybersecurity firm Forescout on more than 2.5 million Internet of Medical Things (IoMT) devices used by more than 50 healthcare delivery organizations. The findings are published in its October 2026 PQC in Healthcare Report.

Quantum computers vastly surpass the computational ability of standard computers as they process information using quantum states. They are capable of tackling complex problems that even today’s supercomputers are unable to solve. A problem tackled by a quantum computer may take minutes or hours compared to millennia by today’s most powerful computers. One such application would be cracking today’s encryption models.

Quantum computers are still under development, but Google has predicted that advances currently being made could render current encryption methods obsolete in the next five years, potentially as early as 2029. While it may appear that there is no immediate risk, encrypted data could potentially be harvested now for decryption later when quantum computing has sufficiently advanced. Forescout warns that the risk is greater in healthcare due to the long-term value of healthcare data, compared to data such as account numbers and payment card information which can be easily changed.

According to the analysis, only 6% of IoMT devices and 16% of operational technology (OT) devices use SSH implementations that support PQC. These devices are relied on by healthcare organizations for a range of functions; however, the lowest percentage of IoMT devices capable of supporting PQC are those used for providing patient care. By comparison, around 50% of IT devices are capable of supporting PQC.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

PQC involves the use of new cryptographic algorithms capable of protecting against attacks from quantum computers; however, healthcare is particularly exposed because many medical devices in use are not capable of supporting PQC, including systems and devices that contain large volumes of highly sensitive healthcare data such as electronic medical records (EMRs), Picture Archiving and Communications Systems (PACS), and devices used for patient care such as patient monitors, imaging systems, infusion pumps, and lab equipment.

These systems and devices tend to have long lifecycles; however, they also have limited paths for upgrading, including upgrades to support new cryptographic standards. Many of these devices and systems are also exposed to the Internet, which makes them vulnerable to attack. The researchers identified 5,500 Internet-exposed systems, including EMRs and PACS. Overall, out of all exposed medical information systems, only 31% supported TLS 1.3 – the only TLS version capable of supporting standardized PDC. The analysis found that 6% of PACS supported TLS 1.3, falling to 33% for EMRs, and 13% for laboratory management systems.

The key to protecting data against quantum-enabled attacks is preparation. “PQC migration is not simply an encryption upgrade project,” said Daniel dos Santos, VP of Research at Forescout. “Healthcare providers need to understand which assets store, process, and transport their most sensitive data, which systems can realistically be upgraded, and where compensating controls will be required. Our research shows that the devices least prepared for the transition are often the same devices healthcare organizations depend on most for delivering patient care. Visibility into those assets and the data they handle is essential for building a practical migration strategy.”

Forescout recommends that healthcare organizations start preparing now by creating a comprehensive and accurate inventory of all systems and devices, including IT, OT, IoT, and IoMT devices, along with data types and connections, prioritizing internet-exposed connections. All assets should be assessed to determine if they are capable of supporting PQC, and any assets that are not should be prioritized for upgrades or compensating controls, especially Internet-exposed connections such as patient portals, external-facing APIs, VPN gateways, and inter-organization data exchange. TLS 1.3 should be enforced, where possible. Any systems that cannot be upgraded should be segmented and isolated, and PDQ readiness should be incorporated into governance, procurement, and risk management processes. ForeScout also recommends ensuring that vendors understand PQC roadmaps if they have not offered alternatives, as well as timelines for migration to PQC.

The post Many Medical Devices Incapable of Supporting Transition to Post-Quantum Cryptography appeared first on The HIPAA Journal.

Citrix has released another patch for a zero day vulnerability under active exploitation, just a few days after patches were released for two other actively exploited zero day flaws. Like the previous two zero day flaws, the latest vulnerability affects Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway appliances. The former is often used to provide cloud applications to employees, while the latter is commonly used as an SSL VPN to provide single sign-on to remote workers.

The previously patched two zero-days can lead to remote code execution; however, the latest vulnerability is believed to only allow an attacker to crash the system, with repeated attacks resulting in denial of service. Citrix explained that it has observed targeted attacks on unmitigated NetScaler systems and has yet to determine the impact on the integrity of customer data. Security researchers have found evidence that threat actors are chaining one of the earlier RCE zero day flaws – CVE-2026-8877 – with the latest vulnerability.

The vulnerability is tracked as CVE-2026-88779 and is rated high severity, with a CVSS v4.0 severity score of 8.7. The flaw is a memory overflow vulnerability in SAML that affects customer-managed deployments configured as a SAML Service Provider (SAML SP / SAML IdP). Citrix also warned that Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerability. Citrix-managed cloud services and Citrix-managed Adaptive Authentication have been automatically updated with the fixed version.

Patches to fix the vulnerability were issued on October 4, 2026. Users who have already patched the previous two zero days will also need to apply the latest fix to protect against exploitation. Citrix is urging all customers with vulnerable appliances to upgrade to the fixed version as soon as possible. Further information can be found in the Citrix security bulletin.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Vulnerable versions:

• Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 prior to 14.1-73.41
• Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 prior to 13.1-64.28
• Citrix NetScaler ADC FIPS prior to 14.1-73.41 FIPS
• Citrix NetScaler ADC FIPS and NDcPP prior to 13.1-37.282

Patched versions:

• NetScaler ADC / NetScaler Gateway versions 14.1-73.41 and later 14.1 releases
• NetScaler ADC / NetScaler Gateway versions 13.1-64.28 and later 13.1 releases
• NetScaler ADC 14.1-FIPS 14.1-73.41 FIPS and later 14.1-FIPS releases
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later 13.1-FIPS and 13.1-NDcPP releases

The post Citrix Patches Third Actively Exploited NetScaler Zero Day appeared first on The HIPAA Journal.

Two critical zero-day vulnerabilities in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) are under active exploitation and require immediate patching. The vulnerabilities are part of a batch of eight flaws detailed in a Citrix security bulletin issued on September 27, 2026. Six of the vulnerabilities are rated high severity, with CVSS v4.0 severity scores between 7.0 and 8.8. The critical flaws have a CVSS base score of 9.5.

• CVE-2026-88771 is a critical remote code execution vulnerability due to improper input validation. Successful exploitation can allow an attacker to execute arbitrary commands. The vulnerability affects all Citrix NetScaler ADC and Citrix NetScaler Gateway deployments.
• CVE-2026-88772 is a critical memory overflow vulnerability that can lead to remote code execution or denial of service. The vulnerability is present if DTLS configuration is enabled on NetScaler ADC or NetScaler Gateway. It is enabled by default on VPN vServer.

The six remaining vulnerabilities are as follows:

• CVE-2026-88775; CVE-2026-88776 & CVE-2026-88777 – (CVSS 8.8) – Memory overflow vulnerabilities leading to unpredictable or erroneous behavior or denial of service.
• CVE-2026-88778 (CVSS 8.8) – TCP Initial Sequence Number (ISN) prediction flaw.
• CVE-2026-88774 (CVSS 7.0) – Feature policy bypass (improper HTTP URL-based expression usage).

The vulnerabilities affect the following Citrix NetScaler ADC and Citrix NetScaler Gateway versions:

• Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37
• Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23
• Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS
• Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279

Software updates have already been applied to fix the vulnerabilities in Citrix-managed cloud services and Citrix-managed Adaptive Authentication. Patches need to be applied to fix the vulnerabilities in customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway deployments. Since two of the vulnerabilities are under active exploitation, customers are urged to upgrade as soon as possible. The extent to which the flaws are being exploited has not been disclosed.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The updated versions with the vulnerabilities fixed are:

• Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases
• Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1
• Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP

The post Citrix Patches Actively Exploited NetScaler ADC & NetScaler Gateway Vulnerabilities appeared first on The HIPAA Journal.

An artificial intelligence (AI) agent developed by OpenAI gained unauthorized access to an Australian Medicare statistics reporting service portal and obtained non-public data. The same AI agent also accessed three other government systems as part of its autonomous research activities: the web portals of the Australian Institute of Health and Welfare, the Victorian Department of Health, and the New South Wales Bureau of Crime Statistics and Research.

An AI agent is an autonomous system that uses an AI model to plan, make decisions, and execute tasks to solve complex problems in response to a prompt from a user or different AI system. In this case, the AI agent was part of an internal model used by OpenAI’s research team for conducting internet-based research into healthcare spending.

While attempting to compile health and medical statistics, the AI agent encountered certain blocks preventing access to data. While the AI agent had no authority to access non-public data, it successfully circumvented the blocks to access data in the Medicare statistics database and also wrote data to the server.

The incident occurred in June 2026; however, OpenAI learned about the issue in August, when in-depth checks of the AI agent’s activity identified actions that were not intended. According to OpenAI, no evidence was found to indicate any patient records were accessed. The data accessed was limited to aggregate health statistics and internal file names. OpenAI informed the Australian government about the incident on September 10, 2026. OpenAI is conducting an extensive review of “misaligned model activity,” and the investigation is ongoing. OpenAI said it is committed to transparency and will share what it learns as the investigation continues.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

“The Medicare Statistics Reporting Portal is a public-facing statistics portal that contains non-sensitive Medicare information relating to data and statistics such as spending. No personal information is believed to have been accessed at this stage, but investigations are ongoing,” Australia Prime Minister Anthony Albanese said. “Evidence currently available is there is no broader compromise to the Services Australia network. Nonetheless, this situation is obviously unacceptable.”

OpenAI has been criticized for the delay in notifying the Australian government. The notice was only received on September 10, and then it was sent to an infrequently checked public mailbox. The Australian Signals Directorate’s Cyber Security Centre found out about the incident on September 15, 2026.

The government has launched a taskforce to conduct an immediate review into the incident to determine whether existing processes are sufficient for responding to AI-related cyber threats, and to assess cybersecurity controls on public-facing websites and apps to determine how they can be improved to counter AI-related threats.

There is growing concern among researchers and tech leaders that advances in artificial intelligence are happening too quickly, and there are insufficient guardrails in place. The AI models currently being developed have demonstrated that they are able to circumvent security measures to gain access to protected data, including exploiting system vulnerabilities to complete the assigned tasks. If a human did the same, it would be considered hacking, and that individual would likely face criminal charges. The law has yet to be tested when the actor is an autonomous AI agent, although it is unlikely that there will be any charges against OpenAI since the data access was unintentional and not malicious.

The post OpenAI Agent Hacks Australian Medicare Portal appeared first on The HIPAA Journal.

A new analysis of ransomware activity reveals broad, consistent targeting pressure across the United States. Ransomware activity is not limited to any specific industry, with all sectors attacked to varying degrees. The analysis was conducted by the AI-driven cybersecurity and threat intelligence platform provider Anomali, with the findings published in its US Ransomware Industry Targeting Report. Anomali observed ransomware targeting across 8 industry sectors by 200 distinct ransomware entities, with its analysis showing that technology was the most targeted sector, followed by manufacturing and healthcare.

Anomali looked at ransomware targeting across eight industry sectors – technology, manufacturing, healthcare, financial services, government public services, construction, education, and energy. There was in excess of 50% observed targeting presence in all eight sectors, with technology companies targeted by 172 of the 200 ransomware entities (86%), followed by manufacturing with 166 (83%), and healthcare in third place with 154 (77%).

The healthcare sector has long been an attractive target for ransomware groups as it is a high-pressure extortion environment combining patient care, protected health information, insurance, payments, and clinical operations, which provides multiple points of leverage for extortion. The healthcare industry is reliant on continuous access to patient data, and any attack that prevents access creates a significant safety risk. There is pressure on victims to recover rapidly, which increases the likelihood of a ransom being paid. Further, a sprawling attack surface, including legacy systems and devices that cannot be patched, makes attacks easier than in many other sectors.

While there are many potential entry points, the most common are unpatched VPNs, firewalls, edge devices, and other internet-facing applications, and these are likely to remain the most high-value entry points into healthcare environments. Internet-facing exposure should be closed before ransomware groups are able to exploit it, focusing on VPNs, firewalls, edge devices, backup platforms, RMM tools, and externally reachable applications.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Anomali recommends treating identity as the primary ransomware boundary and ensuring that phishing-resistant multifactor authentication is implemented for remote access, administrators, SSO, VPN, and privileged service accounts. Exposed RDP should be removed, reviews should be conducted to identify stale accounts, and there should be continuous monitoring for credential exposure and anomalous logins.

File encryption causes significant disruption to healthcare operations, so a rapid recovery is essential. Offline, immutable backups should be created for all critical systems and data, and restoration procedures should be tested under ransomware conditions. Anomali has seen evidence that EDR evasion is becoming a common part of the affiliate playbook and predicts increased use of EDR-killing tools by adversaries over the coming year. Anomali recommends enabling EDR tamper protections, preserving centralized logs, and monitoring PowerShell, RMM, and exfiltration behavior, and rehearsing legal, communications, regulatory, and law-enforcement decisions before an extortion deadline.

“Healthcare organizations face an especially difficult ransomware threat because attackers know that patient care cannot simply pause while systems are restored. As ransomware groups broaden their targeting and reuse the same tactics across industries, healthcare leaders need real-time threat intelligence that helps them identify emerging activity earlier, prioritize the risks most likely to affect their environment and respond before an intrusion disrupts patient care,” Patrick Holt, head of product at Anomali, told the HIPAA Journal.

The post 77% of Ransomware Groups Are Targeting the Healthcare Sector appeared first on The HIPAA Journal.

October is Cybersecurity Awareness Month, a global effort to promote online safety and digital security. Launched in 2024 by the National Cybersecurity Alliance and the Cybersecurity and Infrastructure Security Agency (CISA), the aim is to teach individuals and organizations practical steps to improve resilience to cyber threats. The general theme this year is Don’t Make It Easy for Them, which focuses on everyday digital safety habits that everyone should adopt to improve online safety and security, such as using strong, unique passwords, implementing multifactor authentication (MFA), learning to recognize and avoid phishing, and keeping operating systems, software, applications, and devices up to date.

A dual theme of this year’s Cybersecurity Awareness Month is strengthening critical infrastructure cybersecurity. Securing the nation’s critical infrastructure is a top national security priority under the White House March 2026 Cyber Strategy for America. As the United States celebrates the semiquincentennial anniversary of the nation’s founding, a rallying cry has been issued to future-proof the nation’s critical infrastructure and secure it for the next 250 years.

Critical infrastructure relies heavily on internet-connected systems and devices. Internet access improves efficiency, but it also introduces risks, as Internet-exposed systems, software, and devices can potentially be remotely attacked by cybercriminal actors, hacktivists, and hostile nation-states. Financially motivated criminal threat actors attack vulnerable systems and hold systems and data to ransom; hacktivists may target critical infrastructure in response to governmental policies; and nation-state actors steal intellectual property to accelerate their own economic growth and technological dominance, and conduct destructive attacks to further their nations’ political priorities. Critical infrastructure owners and operators need to defend against these attacks and ensure they can recover quickly should an attack succeed.

The 3Rs of Cybersecurity – Reduce, Replace, Recover

This Cybersecurity Awareness Month, critical infrastructure owners and operators have been requested to practice the 3Rs of cybersecurity – Reduce, Replace, Recover – to improve cyber resilience. Critical infrastructure should improve their efforts to reduce the attack surface by ensuring that systems are kept up to date, patches are applied promptly, and obsolete software and devices are upgraded or replaced before they reach end of life. Plans also need to be developed, implemented, maintained, and practiced to ensure operations can be sustained in the event of a cyber incident and that they can recover quickly from a successful attack.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

While the threat landscape is constantly evolving, CISA points out that it isn’t fundamentally changing; rather, it is scaling. Threat actors constantly search for vulnerabilities to exploit, as has been the case for many years; however, vulnerabilities are being discovered in record numbers. Total published Common Vulnerabilities and Exposures (CVE) this year exceeded last year’s total by the end of August 2026.

Artificial intelligence is accelerating the discovery of software vulnerabilities and is helping threat actors to exploit vulnerabilities far more quickly, including mass exploitation through automation. Since defenders can easily get overwhelmed with the sheer number of vulnerabilities that require remediation, the key approach is to patch smarter, not harder. Vulnerabilities need to be assessed, and remediation efforts prioritized, ensuring that the most critical vulnerabilities are addressed first, such as those listed in the Known Exploited Vulnerability (KEV) Catalog.

When software and devices reach end-of-life, security updates and patches come to an end. Continued use of end-of-life software and devices presents threat actors with opportunities to exploit unaddressed vulnerabilities to gain access to networks and sensitive data. Critical infrastructure owners and operators need to know when support will end for their software and devices and plan to upgrade or replace software, firmware, and hardware devices before support comes to an end. This is especially important for any technology devices or software on the boundary of the network that are accessible from the public internet. Guidance on mitigating risk for end-of-life software and devices is available in BOD 26-02.

It is essential that operations can be sustained in the event of a cyber incident and that a rapid and full recovery is possible. Critical infrastructure owners and operators need to fortify their systems and invest in isolation and recovery capabilities. Vital systems must be isolated from harm and must be capable of continuing to operate in an isolated state, while compromised systems are recovered. CI Fortify is an allied initiative designed to ensure that critical infrastructure entities can continue to operate in the event of geopolitical cyber conflict, through the implementation of resilient OT environments capable of surviving extended isolation and cyber compromise.

All Businesses Should Take Steps to Improve Their Security Posture

Critical infrastructure is supported by a diverse range of businesses, and vendors in the supply chain that are directly or indirectly involved with critical infrastructure are often targeted by threat actors, as they are often a weak link in the security chain. This Cybersecurity Awareness Month, CISA is encouraging all businesses to assess their security posture and implement key cybersecurity best practices, starting with basic, high-impact measures to defend their networks and data:

• Provide phishing education to the workforce
• Strengthen password requirements
• Implement multifactor authentication
• Update business software and patch promptly

With those foundational security requirements in place, businesses should expand their security capabilities by implementing the following measures:

• Log system activity on all business systems
• Back up business data
• Encrypt data at rest and in transit
• Develop and implement an incident response plan
• Report all cyber incidents to CISA
• Prepare for system disruptions

The post Cybersecurity Awareness Month 2026: Critical Infrastructure Urged to Adopt Cybersecurity 3Rs appeared first on The HIPAA Journal.