Security for Hospitals: how to contain ransomware without halting care

Why the hospital is a preferred target — and why that changes the defense

No sector combines, at the same time, as many factors that make a cyberattack attractive to the criminal and devastating to the victim as the hospital sector does. A hospital operates 24 hours a day, 7 days a week, with no real maintenance window: there is no 'shutting the system down on the weekend' when there are patients in the ICU, scheduled surgeries, and emergency rooms receiving cases every minute. That absolute criticality is exactly what the ransomware operator exploits. He knows that, by paralyzing the electronic health record system during a shift, the hospital's leadership faces pressure that no other company faces: the knowledge that downtime can, literally, cost lives. That pressure is what raises the likelihood of ransom payment — and it is why criminal groups deliberately target the healthcare sector.

Add to that the value of the data. The patient's electronic health record concentrates information that cannot be swapped like a card number: clinical history, diagnoses, imaging exams, prescriptions, identification data, health plan information, and frequently data on minors and on stigmatizing conditions. Under the General Data Protection Law (LGPD), health data is sensitive personal data, subject to a heightened protection regime. A health record breach is not merely a reputational problem: it is a security incident with a duty to notify the National Data Protection Authority (ANPD) and the data subjects when there is relevant risk, in addition to exposure to administrative sanctions.

And there is the factor that makes the sector structurally hard to protect: the fleet of connected medical devices, known as IoMT (Internet of Medical Things). Infusion pumps, multiparameter monitors, imaging equipment, PACS workstations, ventilators, and laboratory analyzers typically run old operating systems, without manufacturer support, without the ability to install antivirus, and without an update window — because any restart must be coordinated with clinical operations. These devices are, at once, critical to care and fragile from a security standpoint. Trying to 'harden' each one individually is, in most cases, unfeasible. The correct answer is architectural: isolate the medical network from the rest of the environment through segmentation.

The five threats that most often bring hospitals down

1. Ransomware paralyzing care and 2. Health record breaches

Ransomware is the highest-impact threat. The attacker gets in through any vector — a phishing email opened by a nursing professional, a leaked remote-access credential, an exposed vulnerability in an internet-facing service — and, from a single point, moves laterally across the network until reaching the domain controllers and the servers hosting the health record (HIS/EHR) and support systems (laboratory, pharmacy, imaging). When encryption fires, the hospital simultaneously loses access to prescriptions, exam results, surgical scheduling, and patient history, falling back to paper with direct risk to patient safety. Coupled with it, or on its own, comes the health record breach — the incident of greatest regulatory consequence, since each record is sensitive personal data and the patient cannot 'swap' their clinical history the way they swap a card.

3. IoMT vulnerabilities and 4. Phishing against clinical staff

Connected medical equipment tends to run out-of-support operating system versions, with known vulnerabilities and no available fix. They frequently share the same flat network as administrative computers, which turns them into a pivot point: a compromised device becomes a springboard to the rest of the environment, or gets swept up in the encryption, leaving an entire clinical unit inoperable. Phishing against clinical staff, in turn, exploits the most susceptible audience — physicians, nurses, and technicians are not IT staff and operate under time pressure and emotional load, making them easy targets for a well-crafted email posing as a health plan, an exam center, or IT itself. Phishing is, by far, the most common initial vector of compromise.

5. Improper access to hospital systems

This includes credentials shared at nursing stations, access by service providers and equipment vendors that maintain permanent remote connections, accounts of former employees that were never deactivated, and excessive privilege in systems. Each of these is a door the attacker does not need to break down — they only need to find it open. It is also the quietest vector, because the use of a valid credential rarely triggers alarms without behavioral monitoring.

What is at stake: downtime as a clinical outcome

In any other company, an hour of system downtime is financial loss and friction. In a hospital, it is different in nature. When the electronic health record goes down during a shift, staff lose access to recorded allergies, drug interactions, prescribed doses, critical exam results, and the history that guides clinical decisions. Care does not stop — it continues, but in a degraded mode, on paper, with a greater chance of error. This is why the healthcare attacker's calculus is so perverse: he knows the pressure to restore the system quickly is at its maximum, and he converts that pressure into a lever for extortion.

Hospital defense therefore has three critical time frames: time to detection (the sooner the attacker's presence is noticed), time to containment (the sooner the spread is stopped), and time to recovery (the sooner operations are restored from reliable backups). Decripte works all three simultaneously — because optimizing only one of them leaves the hospital vulnerable on the other two.

How Decripte detects before encryption: the 24x7 SOC

Ransomware does not encrypt the environment the instant it gets in. There is a sequence of behaviors — network reconnaissance, privilege escalation attempts, account creation, access to domain controllers, disabling defenses, scanning for backups, lateral movement between machines. Each of these steps produces signals. Decripte's 24x7 SOC exists to capture these signals in real time, correlate them, and trigger the response before the sequence reaches its final objective.

Monitoring a hospital 24x7 is not optional: attacks are deliberately launched in the small hours, on holidays, and on weekends, exactly when the IT team is reduced and the time to notice tends to be longer. A business-hours monitoring model leaves the environment blind precisely in the windows the attacker prefers. That is why the SOC operates without interruption, with analysts tracking the environment's telemetry across every shift.

Anatomy of the structural defense: segmentation and immutable backup

Detecting and containing is half the work. The other half is architectural and is what prevents the next incident from having the same reach. Two structural decisions transform a hospital's security posture: medical network segmentation and immutable backup.

Medical network segmentation

Most hospitals operate, by historical legacy, on a flat network: the reception computer, the billing workstation, the health record server, the imaging equipment, and the infusion pump coexist in the same network space and can communicate freely. This is the ideal scenario for ransomware, because a single compromised point reaches everything else. Segmentation breaks that network into isolated zones: medical devices (IoMT) in a controlled zone that does not initiate connections to the administrative network; critical health record servers in another; administrative workstations in another; vendor access in a strictly supervised zone. Between zones, only explicitly authorized traffic passes. Because medical devices cannot receive patches or antivirus, segmentation is precisely the control that protects them without touching them: even if a piece of equipment is compromised, it stays trapped in its zone, unable to reach the health record.

Immutable and tested backup

Modern ransomware actively seeks out backups and deletes or encrypts them before detonating — because an intact backup removes the extortion lever. A backup accessible from the production network, therefore, is not protection: it is just another target. Real defense is immutable backup, in copies that cannot be altered or deleted for a defined period, out of reach of the credentials that operate the environment, ideally with an offline copy or one in an isolated account. And immutability without a restore test is false security: Decripte structures the hospital so that restoration is exercised periodically, with recovery time measured and validated — there is no point in having the backup if restoring it takes days while patients wait.

Vulnerability Management: reducing the attack surface before the attack

Containing incidents is response. Reducing the likelihood that they happen is prevention — and that is where Vulnerability Management operates. The hospital environment accumulates attack surface by nature: legacy systems that cannot be shut down, patient and scheduling portals exposed to the internet, equipment with old firmware, remote-access services, integrations with laboratories and insurers. Each is a point that must be inventoried, assessed, and treated.

Decripte's Vulnerability Management continuously maps what is exposed, prioritizes based on real risk — not on a generic severity list, but on what is actually reachable and critical for that hospital — and tracks the remediation cycle. For assets that cannot be fixed, such as many IoMT devices, the answer is the compensating control: segmentation, access restriction, and dedicated monitoring. The result is an attack surface that shrinks over time, instead of growing silently.

Compliance: LGPD, ANPD, and governance in the healthcare context

Under the LGPD, health data is sensitive personal data, subject to more restricted processing grounds and a heightened duty of protection. For the hospital, this translates into concrete obligations: having an adequate legal basis for processing, recording operations, ensuring technical and administrative security proportional to the risk, and — in the event of an incident that could cause relevant risk or harm to data subjects — notifying the National Data Protection Authority (ANPD) and the affected data subjects within a reasonable time.

Decripte's Compliance structures the hospital so that these obligations are met in practice, and not only on paper: it defines the incident-handling process with clear owners, prepares the ANPD notification procedure so it can be executed under pressure, documents the security controls, and helps build information security governance based on ISO 27001. For hospitals that process card payments — in pharmacies, private patients, and insurers — PCI-DSS also comes into play, governing the protection of card data. Compliance here is not bureaucracy: it is what allows the hospital to demonstrate diligence and respond correctly when an incident happens.

The layered defense model Decripte applies to the hospital

No single control protects a hospital. Effective defense is in depth, with layers that reinforce one another: if one fails, the next still holds. Decripte organizes this defense so that each threat in the sector is addressed by more than one control.

This chaining is what makes it possible to assert, based on architecture and not on luck, that an incident will have limited reach. The phishing that captures a credential meets MFA. The credential that gets through meets segmentation. The lateral movement meets the SOC. The attempt to encrypt meets the containment of Incident Response. And if something is still encrypted, it meets the immutable backup. Layer after layer, the hospital ceases to be a single point of failure. To start, the free assessment at decripte.com.br/intelligence-center gives the first view of the risk, and decripte.io/start structures complete protection.

Anatomy of a ransomware attack during the night shift (anonymized real example)

How Decripte responds to an incident in a hospital environment

When the health record is under attack, every minute counts and care cannot stop. Decripte's Incident Response follows a flow designed for the critical healthcare context, with containment in under 1 hour as the central commitment.

1. Detection and triage: the 24x7 SOC identifies the anomalous behavior — lateral movement, disabling of defenses, suspicious authentications — and an analyst quickly confirms it is a real intrusion, not the hospital's operational noise.
2. Immediate activation: the Incident Response team is engaged the instant of confirmation, with escalation to hospital leadership and definition of who decides what, without wasting time figuring out roles in the middle of the crisis.
3. Containment in under 1 hour: surgical isolation of the compromised assets, revocation of the credentials used by the attacker, and suspension of remote access — stopping the spread before it reaches the health record server, keeping the ICU, ER, and surgical center operational.
4. Forensic investigation: identification of the initial vector, the persistence points, the compromised accounts, and the indicators of compromise, to ensure the attacker is fully removed — and not merely silenced temporarily.
5. Exfiltration and LGPD assessment: determination of whether data was stolen before encryption, defining the scope of the potential health data breach and the duty to notify the ANPD and the data subjects.
6. Eradication and recovery: removal of the malware artifacts and persistence mechanisms, followed by restoration from immutable backup, with a predictable recovery time because it has already been tested.
7. Post-incident hardening: immediate deployment of controls that close the exploited gap — segmentation, MFA, backup reinforcement — so that the same path cannot be reused.
8. Report and lessons learned: complete documentation of the incident for leadership and regulatory purposes, with structural recommendations that guide the hospital's next protection phase.

How Decripte structures the hospital's security

Responding well to an incident is necessary, but the goal is for the next incident to have minimal reach — or not happen at all. Decripte structures hospital defense on pillars that reinforce one another, covering detection, architecture, surface reduction, and governance.

Recommended plans for Hospitals

Frequently asked questions

Sector terms

IoMT (Internet of Medical Things)

The set of connected medical devices — infusion pumps, monitors, imaging equipment, laboratory analyzers — that typically run old, unsupported systems, accept neither antivirus nor updates, and are therefore protected mainly by network segmentation rather than by controls installed on the equipment itself.

EHR / HIS (Electronic Health Record / Hospital Information System)

Systems that concentrate the patient's clinical record and the hospital's operations. They are the most critical asset and the final target of ransomware, since their unavailability paralyzes care and their content is sensitive personal health data.

Double extortion

A modern ransomware tactic in which the attacker exfiltrates the data before encrypting it and threatens to publish it if the ransom is not paid. For the hospital, it means that even after restoring from backup, the health data breach has already occurred and must be handled under the LGPD.

Network segmentation

The division of the network into isolated zones — IoMT, health records, administrative, vendors — with traffic restricted to what is authorized between them. It is the control that prevents a single compromised point from reaching the entire environment and that protects medical equipment which cannot be hardened individually.

Immutable backup

A backup copy that cannot be altered or deleted for a defined period, even with administrator credentials, and isolated from the production network. It is what makes recovery independent of the attacker and eliminates ransomware's extortion lever.

ANPD (National Data Protection Authority)

The body responsible for overseeing the application of the LGPD in Brazil. In security incidents that could generate relevant risk or harm to data subjects — such as a health record breach, which involves sensitive health data — there is a duty to notify the ANPD and the affected data subjects.