Cybersecurity Failures Disrupt Patient Care in 70% of Health Care Organizations, Report Finds

More than 90% of health care organizations experienced a cyberattack in the past year, and in 70% of those cases, patient care was disrupted, according to a report released by Fortified Health Security. The findings emphasize the ongoing cybersecurity crisis in the health care sector and point to critical areas that require immediate executive attention. The report, based on Fortified’s interactions with healthcare clients across North America between 2023 and June 2025, reveals the most persistent weaknesses in the industry and the progress that has been made in select areas.

Among the most pressing challenges identified are the absence of unified risk management strategies, inadequate attention to supply-chain vulnerabilities, poor maintenance of legacy systems, incomplete asset inventories, and ineffective employee training. Each of these weaknesses has the potential to exacerbate the others. For instance, a lack of clear asset visibility hampers the ability to remediate supply-chain attacks, which often exploit outdated technologies that are still in operation but poorly supported. This interconnectedness of risks was highlighted during the 2024 Change Healthcare breach, where reliance on a relatively unknown yet widely used vendor caused extensive systemwide disruptions.

Fortified’s analysis also points out that many organizations are prioritizing the implementation of new technologies over maintaining their existing infrastructure. This trend has created a critical imbalance, leaving legacy systems vulnerable to attack. These older technologies, often overlooked, continue to serve as entry points for cybercriminals, especially in environments where system inventories are incomplete or inaccurate. Moreover, employee-related vulnerabilities remain a major concern. With credential theft and phishing serving as common tactics in cyberattacks, the report stresses that the human element of cybersecurity needs far greater attention through structured, frequent training programs.

Despite these persistent threats, the report highlights notable areas of improvement. Securing legacy systems emerged as the most improved domain in the past year, reflecting a growing awareness of the risks they pose. Health care organizations also demonstrated progress in incident recovery capabilities, response planning, and the quality of post-incident communication. These developments suggest that while vulnerabilities remain significant, organizations are beginning to establish more mature and coordinated approaches to cyber resilience.

Additional areas of advancement include improved engagement from executive leadership, more robust risk assessments, and enhanced identity management practices. These gains are particularly relevant as many cyber incidents originate from stolen or forged credentials. Strengthening identity verification systems and enforcing stricter access controls represent critical steps toward minimizing this exposure.

The widespread nature of the issues uncovered suggests that systemic change is needed. Health care executives and business leaders should interpret this report as more than a warning; it is a strategic blueprint for risk mitigation. Cybersecurity must be viewed not simply as a technology function but as a core component of operational integrity and patient safety. The increasing sophistication of attacks and their ability to paralyze care delivery demand a coordinated, well-resourced response from leadership.

Reference

Geller E. Risk management, legacy tech pose major cyber threats to healthcare firms, report finds. Healthcare Dive. Published July 16, 2025. Accessed July 22, 2025. https://www.healthcaredive.com/news/healthcare-cybersecurity-risks-report-fortified/753201/

2025 Mid-Year Horizon Report. Fortified Health Security; 2025. https://fortifiedhealthsecurity.com/horizon-report/2025-Horizon-Report-MidYear.pdf