Ransomware Keeps Targeting Hospitals and Utilities: Why Defences Still Lag

What happened?

Ransomware attacks against hospitals, water utilities and energy operators have continued at a steady pace through 2026, according to monitoring by national cybersecurity agencies, despite years of public warnings, dedicated funding programmes and new regulatory requirements aimed at hardening critical infrastructure against such attacks. Several high-profile incidents this year forced hospitals to divert patients and utilities to switch to manual operating procedures while systems were restored.

Investigations into recent incidents have repeatedly identified familiar weaknesses: outdated software that had not been patched, weak or reused passwords protecting critical systems, and insufficient network segmentation that allowed attackers who breached a single system to move laterally into more sensitive operational technology. Cybersecurity officials say these findings underscore that the challenge is now less about awareness of the threat and more about the practical difficulty of fully remediating decades of accumulated technical debt in complex, resource-constrained organisations.

Key points

• Ransomware attacks on hospitals, water utilities and energy operators have continued steadily through 2026 despite years of warnings.
• Investigations repeatedly identify unpatched software, weak credentials and poor network segmentation as recurring root causes.
• Critical infrastructure operators often run legacy operational technology that is difficult and costly to update without disrupting services.
• Regulatory requirements for incident reporting and minimum security standards have expanded but enforcement and resourcing remain uneven.
• Smaller and rural hospitals and utilities are disproportionately affected due to limited cybersecurity budgets and staffing.

What we know

National cybersecurity agencies that track ransomware incidents report that healthcare and utility sectors remain among the most frequently targeted, a pattern that has persisted for several years. Attackers are drawn to these sectors both because of the sensitivity of the services involved, which increases the pressure on victims to pay ransoms quickly to restore operations, and because many organisations in these sectors operate with constrained cybersecurity budgets relative to the criticality of the systems they run.

Post-incident reviews consistently point to a combination of technical and organisational weaknesses: outdated systems that cannot easily be patched without risking disruption to essential services, insufficient backup and recovery procedures that leave organisations with few options besides paying a ransom, and limited staff trained specifically in cybersecurity within organisations whose primary mission and hiring focus is healthcare or utility operations rather than information technology.

Officials and experts

Cybersecurity officials have repeatedly emphasised that ransomware targeting critical infrastructure is not primarily a technology problem but an organisational and resourcing one, noting that many of the vulnerabilities exploited in successful attacks are well-known and have documented remediation guidance available, yet remain unaddressed due to competing budget priorities and limited specialised staff. Agencies have pushed for mandatory minimum security standards in critical sectors, moving away from purely voluntary guidance that some organisations have been slow to adopt fully.

Healthcare and utility sector representatives have acknowledged the persistent gaps but point to genuine structural constraints, including the difficulty of updating operational technology systems that must run continuously and cannot easily be taken offline for patching, as well as the challenge of competing for scarce cybersecurity talent against better-resourced sectors such as finance and technology. Law enforcement agencies have also highlighted the role of ransomware-as-a-service criminal ecosystems, which have lowered the technical barrier for launching attacks, expanding the pool of actors capable of targeting under-defended organisations.

Background

Ransomware attacks on hospitals and utilities gained widespread public attention several years ago following incidents that disrupted patient care and, in some documented cases, were linked to adverse patient outcomes, prompting a wave of government initiatives aimed at strengthening critical infrastructure cybersecurity. Since then, numerous funding programmes, information-sharing initiatives and regulatory frameworks have been introduced to help these sectors improve their defences.

Despite this sustained policy attention, the persistence of successful attacks reflects the scale and complexity of the underlying challenge. Critical infrastructure organisations often operate a mix of modern information technology and much older operational technology systems, some of which were designed decades ago without cybersecurity as a design consideration, making comprehensive modernisation a slow and expensive process that many organisations have not been able to complete despite years of effort.

Detailed analysis

The persistence of ransomware attacks against critical infrastructure despite years of warnings illustrates a broader pattern in cybersecurity: awareness of a risk does not automatically translate into remediation, particularly when addressing the risk requires significant capital investment, specialised staff and operational disruption that resource-constrained organisations struggle to absorb. Hospitals, for example, often operate on thin margins and must prioritise clinical staffing and equipment over information technology upgrades, even when the cybersecurity risks are well understood by leadership.

The specific vulnerability of operational technology systems, the specialised equipment that controls physical processes such as water treatment, power distribution and medical devices, adds a layer of complexity not present in typical office information technology environments. These systems often cannot be patched using standard methods without risking disruption to the physical process they control, and many were never designed with network security in mind because they predate the widespread connection of such systems to broader corporate networks and, ultimately, the internet.

Regulatory responses have evolved considerably, with several jurisdictions introducing mandatory incident reporting requirements and minimum cybersecurity standards for critical infrastructure operators, moving away from the largely voluntary guidance that characterised earlier policy approaches. However, the effectiveness of these regulations depends heavily on enforcement capacity and on whether regulated organisations receive adequate support, whether financial or technical, to actually meet the new requirements, rather than facing penalties for non-compliance without a realistic path to remediation.

The economics of ransomware itself also continue to work against defenders. Ransomware-as-a-service platforms have lowered the technical skill required to launch an attack, allowing a wider range of criminal actors to target smaller, under-defended organisations that might previously have been considered too unsophisticated a target to be profitable. This has contributed to a pattern where smaller hospitals, rural utilities and local government-run infrastructure, which often have the least capacity to invest in cybersecurity, face a disproportionate share of successful attacks relative to larger, better-resourced organisations.

Insurance markets have also adapted in response to the persistent risk, with cyber insurance providers increasingly requiring evidence of specific security controls, such as multi-factor authentication and tested backup systems, before offering coverage or in order to qualify for lower premiums. This has created an indirect but meaningful incentive for organisations to adopt baseline security measures, functioning in some respects as a market-based complement to regulatory requirements, though gaps remain for organisations that cannot afford adequate coverage or that choose to self-insure against the risk.

Why it matters

Ransomware attacks on hospitals and utilities pose risks that extend beyond financial loss or data theft, potentially disrupting essential services that communities depend on for health and safety, including emergency medical care and clean water supply. The persistence of these attacks despite sustained policy attention highlights the limits of awareness-raising alone and the need for sustained investment and enforcement to close well-documented security gaps.

For policymakers, the ongoing pattern of successful attacks against well-warned sectors raises questions about whether current regulatory and funding approaches are adequately matched to the scale of the underlying technical debt in these industries. For the public, the issue underscores that essential services increasingly depend on the cybersecurity resilience of organisations that, in many cases, were not originally designed or funded with that resilience as a priority.

What happens next?

Expect continued expansion of mandatory cybersecurity requirements for critical infrastructure operators in multiple jurisdictions, alongside growing pressure on governments to pair these requirements with dedicated funding support, particularly for smaller and rural providers that lack the resources to comply unassisted. Cyber insurance requirements are likely to continue functioning as an informal but meaningful driver of baseline security adoption across affected sectors.

The persistence of successful attacks despite years of warnings suggests that meaningful improvement will likely be gradual rather than sudden, tied closely to the pace at which resource-constrained organisations can modernise legacy systems and build dedicated cybersecurity capacity, a process that officials acknowledge will take years rather than months to complete.