Black Kite Research Finds Certain Ransomware Groups Disproportionately Target Healthcare Organizations

Physicians offices and general medical hospitals make up the greatest number of victims

/EIN News/ -- BOSTON, Jan. 22, 2025 (GLOBE NEWSWIRE) -- Black Kite, the leader in third-party cyber risk intelligence, published new data from the Black Kite Research Intelligence Team (BRITE) that shows certain ransomware groups are disproportionately targeting healthcare organizations. Ransomware groups Everest and Monti lead with 25% and 20.8%, respectively, of their victims in healthcare. Notably, high-volume groups INC Ransom (21.7%) and BianLian (15%) show a strong healthcare focus, making them especially dangerous to the sector.

Since last year, Black Kite research has reported that healthcare is the third-most-targeted industry by ransomware groups, behind manufacturing and professional services, and new data shows that within the market, physicians' offices comprise 25% of the victims. General medical and surgical hospitals are the second-most-targeted industry group, making up 22% of healthcare victims, followed by other health professionals offices, such as dentists and outpatient centers. And threats extend beyond ransomware. Research shows that overall attacks on healthcare organizations surged by 32% year-over-year.

The study shows the high-profile Change Healthcare attack was a tipping point for ransomware groups. This incident marked a breaking point in the ransomware ecosystem, exposing vulnerabilities in the traditional group-affiliate structure and driving the shift to more aggressive, affiliate-dominated models. While established groups may have bypassed organizations with a high human risk factor, today’s ransomware groups target sectors based on ease of access and ransom potential, often disregarding traditional ethical considerations.

“The fallout from Change Healthcare fundamentally altered how ransomware groups operate, making healthcare organizations prime targets,” said Ferhat Dikbiyik, chief research and intelligence officer at Black Kite. “Threat actors have refined their tactics to maximize efficiency, evade law enforcement, and increase their chances of securing ransoms. These shifts in both tactics and target criteria have made ransomware attacks more frequent, unpredictable, and strategically devastating, especially in the healthcare industry.”

In the report, BRITE breaks down the affiliate ecosystem structure and victim profiles. Most groups select victims based on technical vulnerability, industry profile, and likelihood of paying the ransom. As a result, organizations that are less protected and resource-constrained, such as small healthcare businesses with less than $20 million in revenue, are prime targets. However, large organizations with greater than $100 million in revenue are also at high risk because of their ability to pay sizable ransom demands.

In an increasingly hostile cyber landscape, it’s essential for healthcare organizations to take proactive measures to avoid attracting ransomware groups. Preventing the devastating impacts of ransomware and keeping systems and data available and protected is, in many cases, a matter of life and death. BRITE recommends continuously monitoring those factors that elevate risk — unpatched systems, compromised credentials, and missing security controls, among others — monitoring vendor and supplier ecosystems, and implementing robust cyber hygiene practices. Ultimately, a proactive, layered approach can help healthcare organizations safeguard their operations and, most importantly, keep their patients safe.

Visit the website to read the healthcare report or download the State of Ransomware 2024: A Year of Surges and Shuffling.

About Black Kite
Black Kite gives companies a comprehensive, real-time view into cyber ecosystem risk so they can make informed risk decisions and improve business resilience while continuously monitoring more vendors, partners, and suppliers in an ever-changing digital landscape.

Through an automated process, and a combination of threat, business and risk information, Black Kite provides cyber risk intelligence that goes beyond a simple risk score or rating.

Black Kite serves more than 3,000 customers in a wide range of industries and has received numerous industry awards and recognition from customers.

Learn more at www.blackkite.com, or on the Black Kite blog.

Copyright © 2024 Black Kite, Inc. All rights reserved. All other brand names, product names, or trademarks belong to their respective holders.

Media Contact:
Geena Pickering
Look Left Marketing
blackkite@lookleftmarketing.com