Summary
- Comparitech recorded 306 healthcare-sector ransomware incidents and claims in Q3, including 53 confirmed incidents.
- Hospitals and other direct care providers accounted for 192 cases, while healthcare-related businesses accounted for 114.
- The findings highlight exposure across healthcare delivery and supporting technology and manufacturing supply chains.
Recorded ransomware incidents and criminal claims involving healthcare organisations increased by 40% in the third quarter of 2026, according to research showing continued pressure on hospitals, care providers, medical suppliers, and healthcare technology companies.
Comparitech recorded 306 incidents and attack claims involving healthcare providers and businesses between July and September, compared with 219 in the preceding quarter.
The figures include 53 incidents confirmed through organisational disclosures or corresponding evidence, alongside 253 claims that had not been independently confirmed at the time of the research.
This distinction is central to interpreting the reported increase. A claim published by a ransomware group is not equivalent to an independently verified breach, and the number of confirmed cases may change as organisations investigate or disclose incidents.
The healthcare-specific study, published on 15 October, follows Comparitech’s broader quarterly ransomware analysis and provides a more detailed assessment of the sector.
Healthcare providers and suppliers face different exposure
Of the 306 cases recorded, 192 involved hospitals, clinics, and other organisations delivering care directly to patients.
Within that group, 40 incidents were confirmed and 152 were classified as unconfirmed claims.
Comparitech identified 618,149 records known to have been compromised in the confirmed provider incidents, although that figure does not represent a complete measure of all data potentially affected during the quarter.
The median publicly identified ransom demand involving healthcare providers was $300,000.
The remaining 114 cases involved businesses supporting the healthcare sector, including medical manufacturers, healthcare technology suppliers, pharmaceutical businesses, and organisations providing related services.
Thirteen of those cases were confirmed, while 101 remained unconfirmed. The median reported ransom demand in this group was $150,000.
Comparitech did not establish a confirmed aggregate record-loss figure for these healthcare business incidents.
The difference between direct care providers and their suppliers is operationally important because cyber disruption can affect healthcare delivery through several routes.
A hospital may face direct interruption of clinical or administrative systems, while compromise of a supplier can disrupt the software, equipment, logistics, or services on which multiple healthcare organisations depend.
Healthcare technology shows rapid growth in claims
The research records a 42% quarterly rise in incidents and claims involving direct care providers and a 36% increase involving healthcare businesses.
Within the latter category, healthcare technology companies experienced particularly rapid growth, rising from eight cases in Q2 to 22 in Q3.
That represents a 175% increase, although the relatively small starting number means the percentage should not be interpreted as evidence that healthcare technology has become the largest target category.
Healthcare manufacturers accounted for 51 cases, compared with 40 in the preceding quarter.
The figures reflect a sector in which clinical care increasingly depends on a complex collection of software platforms, connected devices, specialist suppliers, and outsourced business processes.
Those dependencies can create concentrated operational exposure when an external service supports multiple healthcare customers.
The report does not establish that all attacks involving healthcare businesses interrupted patient treatment. The potential for such disruption depends on the role of the affected supplier and whether alternative services were available.
European incidents and ransomware groups
Although the United States accounted for the largest share of cases, Comparitech also identified activity involving healthcare organisations in European countries.
Germany and Italy each recorded seven incidents and claims during the quarter, while the report identifies confirmed cases involving organisations in Switzerland, Italy, Poland, and the UK.
Comparitech reported a confirmed attack involving UK healthcare technology business Craneware, while other examples included Swiss healthcare organisation Stiftung Wagerenhof and Polish pharmacy Zdrowit.
These cases differ in timing, consequences, and the information disclosed by the affected organisations. They should not be treated as evidence of one coordinated campaign.
The report also identifies ransomware groups appearing frequently in claims against healthcare organisations.
The Gentlemen, INC, Qilin, and other groups feature prominently in different parts of the dataset, but the leading group by unconfirmed claims is not necessarily the group responsible for the largest number of verified incidents.
Comparitech found that Chaos had the highest number of confirmed cases across the two healthcare categories, illustrating the difference between criminal publicity and confirmed activity.
The source data also separates ransom demands from payments. A demand recorded in a criminal communication does not establish that the targeted organisation paid the amount.
Patient data and operational resilience
Ransomware incidents involving healthcare systems carry additional consequences because organisations may hold clinical records, identifying information, payment details, and sensitive operational data.
Loss of access can interfere with scheduling, communications, administration, and other functions that support patient treatment.
Data compromise introduces a separate risk to individuals whose information may be disclosed or misused after a system has been restored.
Those consequences are not always apparent during the first public disclosure of an incident. An organisation may initially report service disruption or state that it has not identified evidence of data theft, before subsequent investigation reveals that information was accessed.
Comparitech notes that reported figures are subject to revision as cases are confirmed and records of earlier activity are updated.
The research provides evidence of a substantial increase in recorded healthcare ransomware activity, but most entries in the dataset remain unconfirmed criminal claims.
The verified incidents, combined with the concentration of activity among healthcare providers and their supporting businesses, demonstrate why the sector’s cyber resilience cannot be assessed solely through the security arrangements of hospitals themselves.
