Topic
Cybersecurity threats, breaches, and defensive practices affecting hospitals, health systems, and the software vendors that serve them.
Health-ISAC warned members in September 2026 that ShinyHunters-linked crews extort healthcare without encrypting files, in one case taking over 1TB. A dev.to write-up of the warning points to new factor enrollments and bulk exports as the signals to watch.
Reality
iRhythm, maker of the Zio patch, says attackers who social-engineered access to third-party-hosted apps took data on at least 360,000 patients. The records link patients' insurance numbers to their device serial numbers, enough detail for a caller to pass as the company.
Reality
Belarusian Cyber Partisans say they took admin access to Moscow's health department network in 2023, including systems linked to other agencies. Solar, the Rostelecom unit that found the intrusion, puts the first trace a year later, so the two sides disagree on how long the attackers were inside.
Reality
Forescout found post-quantum-capable SSH on 6% of IoMT and 16% of medical OT devices in a 2.5 million-device study of over 50 healthcare organizations. With long device lifecycles and few upgrade paths, hospitals are left planning around segmentation.
Reality
Senators passed the Health Care Cybersecurity and Resilience Act by unanimous consent after the 2024 version died with its term. If the House agrees, healthcare's security rules get updated, with federal grants and training attached.
Reality
Health Minister Jung Eun-kyeong conceded Korea's hospitals trail attackers as lawmakers showed 16.7% of 263 general hospitals budget nothing for security. The promised fix, preemptive testing, has no budget yet, so whether hospitals or the state pays is open.
Reality
Security firm Solar says Belarusian Cyber Partisans were inside an unnamed Russian healthcare network from early 2024 until its discovery in December 2025. That network connects to numerous other providers, and Solar says the foothold gave the intruders a possible route into them.
Reality
Epic has stopped most product development for roughly six weeks while it fixes MyChart flaws that an AI model uncovered, according to TechCrunch. No list of affected portal setups is public yet, so hospitals cannot check theirs against one.
Perspective Coverage
3 publishersReality
The updated CISA-FBI advisory puts Medusa at more than 500 victims as of April 2026, up from 300, with exploits weaponized within 24 hours and sometimes a week before disclosure.
Perspective Coverage
7 publishersReality
The Toronto hospital says the flaw sits in software used by other organizations too. It has not said which software, which leaves those organizations nothing to act on.
Perspective Coverage
4 publishersReality
The distributor found the intrusion on August 25, 2026, the same day ShinyHunters says its four-day exfiltration ended. It has not named the vendor applications involved, so customers are left scoping their own integrations.
Perspective Coverage
9 publishersReality
Three flaws in NextGen Healthcare Mirth Connect 4.7.1 and earlier share a single fix in version 4.7.2. The one that changes blast radius lets an authenticated user read the engine's stored credentials for connected systems.
Reality
The money leaves by card and not by password, which puts this portal impersonation wave in the hands of hospital comms teams that neither wrote the software nor control the sender addresses. Epic's answer is the guidance it already published.
Reality