Every U.S. industry sector drew ransomware attention in an Anomali study, but only two were pursued by more groups than healthcare.
The headline number belongs to healthcare’s share of the field: 154 of the 200 extortion crews Anomali tracked were seen pursuing the sector, a 77% targeting rate. Technology drew more, at 172 groups (86%), and manufacturing came in at 166 (83%), but healthcare’s third-place finish still put it ahead of financial services, government, construction, education, and energy. Every sector landed above 50%.
Why healthcare ranks so high comes down to leverage. A single hospital combines clinical care, patient records, billing, insurance, and round-the-clock operations, so an outage creates immediate pressure to resolve it. Records that cannot be reached during a shift are a patient-safety concern, not just an IT one, and that urgency works in a negotiator’s favor.
The scale is what stands out. Being hit by three quarters of 200 tracked crews puts healthcare in the path of a marketplace rather than a single adversary, meaning ransom demands can arrive from operators of almost any size and maturity.
Anomali measured targeting presence, not confirmed intrusions, and named no healthcare victims. Even so, the picture matches a year of hospital outages, vendor breaches, and disruptions that pushed pharmacy and laboratory staff back onto paper.
The defensive read is straightforward: assume the knock is coming and prepare for the downtime, with tested backups, segmented networks, and recovery plans built around the bedside rather than the data center.
