Healthcare Ransomware Attacks Rise 14% in H1 2026 — Now Averaging 2.3 Per Day
410 attacks hit healthcare organizations globally in the first half, with attackers shifting toward supply-chain and business-services targets. Median ransom demand: $310,000.
Healthcare ransomware attacks rose 14% in the first half of 2026 compared with the second half of 2025, reaching 410 total attacks — an average of 2.3 per day globally — according to Comparitech's H1 2026 healthcare ransomware roundup.
Of those, 247 attacks hit healthcare providers directly (55 confirmed, with 424,740 patient records breached in confirmed incidents; median ransom demand $310,000), while 163 hit healthcare businesses such as billing firms and technology vendors (22 confirmed; 154,825 records; median demand $300,000).
The supply chain is the new target
The most important trend in the data is the shift toward healthcare's supply chain. Attacks on healthcare businesses jumped 35%, and attacks on medical device retailers and wholesalers surged 67%. The logic is grim but sound: a billing or technology vendor holds data on many providers at once, so a single breach cascades across the sector.
Notable incidents in the half included Unimed Germany (135,000 patients affected, April), Nippon Medical School Hospital in Japan (131,700 affected, with a $100 million demand from the NetRunner gang, February), and Caribbean Medical Center in Puerto Rico (92,000, February). The dominant gangs: Qilin, The Gentlemen, DragonForce, and LockBit.
The numbers land in the middle of a US policy debate over mandatory hospital cybersecurity standards — and give ammunition to those arguing that voluntary frameworks have run their course. For health IT leaders, third-party risk management is no longer an audit checkbox; it is the primary attack surface.
Reporting: Comparitech H1 2026 healthcare ransomware report, published July 7, 2026.
Source
Original reporting: Comparitech ↗