For years, cybersecurity experts have raised alarms over security risks within the U.S. healthcare industry, as cybercriminals and threat actors target vulnerable infrastructure, including systems containing sensitive patient records and other data. At the same time, attracting skilled cybersecurity professionals to the industry has proved difficult.

In the first half of 2026 alone, the U.S. Department of Health and Human Services’ Office for Civil Rights reported 397 large healthcare data breaches — incidents affecting 500 or more people — that exposed information on nearly 33.8 million individuals.

The 2024 ransomware attack that targeted UnitedHealth Group’s Change Healthcare subsidiary, which affected a staggering 190 million people, illustrates the cybersecurity challenges the healthcare industry faces.

In response to the Change Healthcare attack, the U.S. Senate passed a bipartisan bill in October called the Health Care Cybersecurity and Resiliency Act of 2026.

The Senate bill – lawmakers in the House have yet to take up the measure – would require healthcare providers and organizations to make several changes. Among its provisions are:

  • A requirement for all private healthcare-related entities to adopt minimum cybersecurity standards, such as multifactor authentication
  • A requirement to expand and update every two years a plan detailing cybersecurity protocols for HHS personnel
  • A requirement to provide training and best practices to help expand the healthcare cybersecurity workforce

While the Change Healthcare ransomware incident stands out because of the large number of victims and personal data affected, other breaches, attacks and vulnerabilities also demonstrate the fragile state of cybersecurity in the healthcare industry.

Despite legislative scrutiny and regulations requiring healthcare providers to report incidents and better protect electronic patient records and other sensitive personally identifiable information (PII), the industry lacks enough skilled cybersecurity professionals to safeguard its networks and infrastructure.

Although no official count of open cybersecurity positions in healthcare is available, a LinkedIn search in October identified between 10,000 and 11,000 U.S. job opportunities, including roles for CISOs, cybersecurity engineers and cybersecurity analysts.

“The healthcare industry is dealing with limited cyber funding and IT teams under enormous operational pressure,” Robert Costello, chief digital and information officer at Merlin Group, said. “That inevitably leads to deployments that meet the mission need but are not always architected the way we would want from a security standpoint.”

As the healthcare industry drives significant job growth in the U.S., according to the Bureau of Labor Statistics, experts say cybersecurity professionals should consider the sector for opportunities to gain experience or take on new career challenges.

Cybersecurity Issues Within Healthcare

Healthcare is a significant cybersecurity concern partly because hospitals, clinics and other organizations retain vast amounts of data. That includes patient information, payment data and other critical records.

Once cybercriminals access this PII, they can use it to extort victims and create other risks, said Tim Mackey, head of software supply chain risk strategy at Black Duck.

“Health information is arguably the most sensitive personal data available,” Mackey told Dice. “Cybercriminals can use that information in very targeted attacks. After all, if you receive a phone call and someone purporting to be from your clinic asks for payment and knows what your care plan looks like, you’ll likely pay up.”

Attackers may also poison data sets.

“For example, if you have hypertension and the medication dosage were changed, that modification to your treatment plan could be disastrous,” Mackey added. “All this to say that everyone involved in healthcare, from device manufacturers through to providers, needs to invest in threat modeling risks, knowing that cybercriminals don’t seem to care about patient health.”

The healthcare sector has long been underprepared for increasingly sophisticated attacks. Nearly a third of data breaches also involve compromised third parties.

These vulnerabilities expose organizations to costly ransomware attacks, said James Maude, field CTO at BeyondTrust.

“To skillfully deal with ransomware and other threats, we must invest in shifting left and think more about securing identities and access to reduce our attack surface and blast radius in the event of compromise, rather than simply thinking post-breach,” Maude told Dice. “Ransomware and other threats are only as effective as the privileges and access they manage to acquire, so if we can implement better hygiene and place emphasis on least privilege, then the threat actors are far less likely to ransomware us in the first place.”

The April cyberattack by the ShinyHunters gang on Medtronic, which develops and manufactures device-based medical therapies and healthcare solutions, affected about 9 million records containing PII. The incident illustrates the cybersecurity challenges facing healthcare organizations, said Agnidipta Sarkar, chief evangelist at ColorTokens.

“This attack highlights the escalating threat landscape facing the healthcare and medical technology sectors. While Medtronic successfully contained the breach to its corporate IT network, preventing disruption to its manufacturing and product lines, the incident underscores the critical need for robust measures to be ready for the next possible breach,” Sarkar told Dice. “At the heart of the challenge are high levels of both complexity and uncertainty. It’s time to keep abreast of geopolitical signals, anticipate attacks, model defenses and adapt digital landscapes to deny attackers any room to maneuver.”

Shane Barney, CISO at Keeper Security, said many healthcare organizations are strengthening identity security to limit access to sensitive patient and payment data.

“Some healthcare organizations now require both a physical credential and a PIN before a clinician can interact with sensitive equipment or patient data. When unauthorized access to medical infrastructure carries real-life safety consequences, the bar for identity assurance has to be higher than a single factor,” Barney told Dice. “That bar should also extend to the quality of the factors themselves. SMS-based codes, still common in many of these environments, remain vulnerable to interception and SIM-swapping. Phishing-resistant methods, including FIDO2 hardware security keys and passkeys, offer a meaningfully stronger guarantee and are increasingly practical to deploy in nontraditional settings.”

Cybersecurity Pros and Healthcare

Given the number of connected and IoT devices used throughout the healthcare industry, Merlin Group’s Costello said hospitals and clinics need cybersecurity professionals who understand the risks and can help build security into devices from the start.

“We also need to give the IT teams operating them the training, visibility and affordable solutions needed to secure these environments,” Costello told Dice. “That means knowing what is connected, enforcing least privilege, properly segmenting systems and being able to isolate a device when necessary, without disrupting patient care or the mission.”

As artificial intelligence use grows, Aviv Nahum, co-founder and CEO of Above Security, said healthcare organizations increasingly need cybersecurity professionals who understand how AI tools and autonomous agents work. These experts can help address concerns about data access, particularly when employees use the tools without fully considering the risks.

“Organizations must start with visibility. Employees should be trained to know which agents are touching your systems, both your own and external ones, and be able to reconstruct what they actually did,” Nahum told Dice. “Treat an agent with access to patient or claims data the way you'd treat a new employee with the same access: least privilege, a named owner, and continuous review of whether its behavior still matches its job. Cyber pros shouldn’t rely on a single perimeter control. Assume the first control will be bypassed and watch what happens behind it.”

Given the number of cybersecurity issues involving identity and access, Keeper Security’s Barney said healthcare organizations need cybersecurity professionals who understand zero trust principles and can apply them across the organization.

“The lesson for security leaders is straightforward. The zero trust principle of never extending implicit trust based on a single credential doesn't stop at the firewall,” Barney noted. “Whether someone is unlocking a server room or accessing a medical device, the underlying question is the same: can you prove who you are through at least two independent channels? Organizations that apply that discipline consistently across their physical and digital environments, not just their IT stack, close a category of risk that most threat models still don't account for.”