Every time you hear news of a ransomware attack on a hospital, you may well have wondered, "Is our hospital going to be all right?"
In the case of Tsurugi Town Handa Hospital, in-hospital systems including electronic medical records went down, and records show that rebuilding and data recovery took about two months, with recovery-related costs of just over about 70 million yen. The damage is not just "a data-leak problem"; it can shake clinical operations themselves for a long time.
At Osaka General Medical Center, the hospital disclosed an attack that began from a contractor's connection path. No matter how well a hospital hardens its own network, connections used by outsourced services such as catering, cleaning and medical equipment can become the point of entry. This is a pitfall that medical institutions find particularly easy to overlook.
There is one more thing to keep in mind: the regulatory side.
With the amendment to the Enforcement Regulations of the Medical Care Act in force since April 1, 2023, "ensuring cybersecurity" was positioned as a matter that administrators of medical institutions must comply with. In other words, defenses are no longer "something to do if possible"; they are required to be effective.
What you will learn in this article
- Why hospitals are easy targets for ransomware (what happens structurally)
- Seven hospital ransomware cases, mainly from 2021 to 2025 (causes, recovery periods and characteristics of the damage)
- What happens when a hospital is hit (clinical care, costs and legal risk)
- The key points of the MHLW guidelines and the new obligations, and which defenses to prioritize on the ground
- The initial response to an infection (what to do and what not to do in the first few hours)
For an overview of cases across all industries, see the article below.
Preparation in advance is essential against ransomware, and vulnerability scanning and penetration testing are effective. CyberCrew has multiple white-hat hackers on staff who assess your risk through hands-on testing that starts from the points real attackers target. Start with a free consultation.
Five reasons hospitals are targeted by ransomware
Compared with ordinary companies, hospitals are more likely to be seen by attackers as places where "stopping operations has a big impact" and "negotiations move quickly," and as a result they tend to become ransomware targets.
Behind this are circumstances unique to healthcare: high-value medical information, operations that must run 24 hours a day, legacy equipment that is hard to update, and operations run with limited staff.
Here we lay out the five main reasons hospitals are targeted by ransomware.
1. Patients' personal and medical information is highly valuable
Medical information tends to bring together not only basic details such as names, addresses and contact information, but also insurance information, visit history and test results, all "important material that proves a person's identity."
This kind of information can be abused to get past identity checks in account takeovers, and for impersonation, fraud and extortion, and secondary damage from a leak tends to drag on for a long time.
That is why healthcare is consistently named as a "frequently targeted industry" in threat reports.
2. Because lives are at stake, hospitals are seen as likely to pay
Hospitals are expected to run 24 hours a day, and when electronic medical records, order-entry or laboratory systems stop, they are immediately forced to decide whether to restrict care or stop accepting patients.
Unlike ordinary companies, they cannot easily think in terms of "shutting down over the weekend to recover," and staff must get back to normal operations as quickly as possible, every minute counts.
Attackers understand this and step up the pressure, expecting that "operations can't be stopped, so negotiations will move quickly" and "they will have no choice but to consider paying."
This structure is one reason healthcare is cited as a major ransomware target.
3. Security measures lag behind those of ordinary companies
Small and mid-sized hospitals often run IT with a single staff member, or a small team that includes people with other duties, and on the ground the priority inevitably becomes "not stopping today's patient care."
Configuring additional devices, fixing printer problems, coordinating with the electronic medical record vendor, first-line response to network failures: the day fills up with "work that has to be fixed right away."
As a result, "security work that is truly necessary but easily postponed," such as vulnerability management, log monitoring and staff training, tends to be neglected.
The longer conditions such as delayed updates, outdated permission designs and thin monitoring continue, the easier the environment becomes for attackers to get into.
4. Old systems and equipment stay in service
Unlike ordinary business systems, electronic medical records and medical devices cannot be replaced easily. Replacement requires large costs and long lead times, and update cycles tend to run five to ten years.
Meanwhile, operating systems and middleware have support end dates, and when those come first, situations arise where hospitals "really want to upgrade" but cannot, because of compatibility with medical devices, manufacturer certification or integration testing.
As a result, old operating systems and components remain inside the hospital, and from the attacker's point of view, it looks like a place where "vulnerabilities are likely to remain."
This structural gap is one of the reasons healthcare is so easily targeted.
5. The misconception that "a closed network is safe" is widespread
You may hear that "the hospital LAN is a closed network, so it's safe," but this often does not match reality.
For example, a VPN may be in place so the electronic medical record vendor can perform maintenance from outside the hospital, or there may be a path for contractors to remotely monitor and inspect equipment.
In that case, even if the in-hospital network itself "is supposed to be closed," entry points connecting to the outside inevitably exist somewhere.
The problem is that these entry points remain hard to see, while only the sense of security that "it's closed, so it's fine" remains. As a result, updates to VPN appliances and perimeter devices are postponed, and MFA and stronger passwords are not fully rolled out, leaving conditions that make it easy for attackers to get in.
Seven hospital ransomware cases (2021-2025)
Since 2021, ransomware attacks on hospitals have continued to occur.
A notable pattern is intrusion through the same kinds of entry points (VPNs and contractor connections, delayed updates, weak authentication), and many of the factors will make you think, "these conditions might apply to us too."
Here we introduce seven hospital ransomware cases whose causes and outcomes have been documented.
[Case 1] Tsurugi Town Handa Hospital, Tokushima Prefecture (October 2021)
At Tsurugi Town Handa Hospital in Tokushima Prefecture, a ransomware infection made electronic medical records, billing and other systems unusable, affecting patient care. (Reference: Tsurugi Town Handa Hospital, "On the Investigation Report of the Expert Panel on the Computer Virus Infection Incident")
The Handa Hospital case showed that "a hospital grinding to a halt" is not a figure of speech.
In the early hours of October 31, 2021, a criminal statement printed out of the hospital's printers, revealing an infection with the "LockBit 2.0" ransomware. In-hospital systems including electronic medical records were encrypted, and clinical care was severely restricted, including a switch to paper-based operations.
The most likely intrusion route is considered to be the exploitation of a known vulnerability in a VPN appliance. Recovery took about two months, and costs, including investigation, outsourcing and personnel, reached around 70 million yen.
This case shows that even a closed network is not necessarily safe, and that managing perimeter devices and building a proper organizational structure are essential.
[Case 2] Osaka General Medical Center (October 2022)
In October 2022, important systems at Osaka General Medical Center, including electronic medical records, were affected by ransomware, and as a result a long recovery effort was required. (Reference: Osaka General Medical Center, "On the Incident Investigation Report")
This case confronted hospitals with the reality that "the hospital's own defenses" alone cannot provide full protection.
The cause was a supply-chain intrusion reportedly via a contractor's VPN, in which an external connection path effectively became a weak point in the hospital's internal network. Recovery proceeded in stages, and paper-based operations and restricted care continued for a long time. The case showed that remote maintenance requires control that extends beyond technical measures to MFA, log management, contracts and operations.
When in-hospital systems stop, the hospital has no choice but to reorganize its clinical priorities. In particular, medical institutions have many partners and contractors, and connection paths set up for convenience can end up becoming "entry points that are easy to target."
[Case 3] Okayama Psychiatric Medical Center (May 2024)
At Okayama Psychiatric Medical Center, a ransomware attack in May 2024 brought down in-hospital systems including electronic medical records. (Reference: Okayama Psychiatric Medical Center, "On the Ransomware Incident Investigation Report")
The Okayama Psychiatric Medical Center case is a textbook example of ransomware whose impact does not end with "things stopping."
It has been pointed out that unaddressed vulnerabilities in a VPN appliance used for maintenance, and the use of guessable IDs and passwords, may have been the breakthrough points.
Recovery proceeded in stages and took more than 90 days. This case shows that a partial gap in security can lead to the entire hospital coming to a halt.
[Case 4] Uda City Hospital, Nara Prefecture (October 2018)
At Uda City Hospital in Nara Prefecture, in October 2018 part of the in-hospital system was disrupted, and electronic medical records could not be accessed. (Reference: Uda City Hospital, "Report" on the Computer Virus Infection Incident)
The Uda City Hospital case clearly shows that "sophisticated intrusions from outside" are not the only threat to hospitals.
The infection route should be identified with caution, but the possible (suspected) involvement of a personal PC belonging to a staff member or contractor being connected has been indicated as a cause. In other words, a device outside the in-hospital network slipped through a gap in operations and was treated as "part of the hospital network."
Recovery is said to have taken about six months, and the fact that the impact did not end quickly should not be overlooked.
[Case 5] Kokubu Seikyo Hospital, Kagoshima Prefecture (February 2024)
At Kokubu Seikyo Hospital in Kagoshima Prefecture, a ransomware attack in February 2024 encrypted data on a server, and the hospital disclosed impacts on medical records and the possibility of a personal information leak. (Reference: Kokubu Seikyo Hospital, "On the Failure of the Image Management Server")
The Kokubu Seikyo Hospital case shows the danger of thinking that "protecting only the main systems is enough." Departmental servers for imaging, laboratory and document management may seem like back-office systems, but they are the foundation of patient care; when they stop, staff are suddenly back to manual work, which directly affects the quality and speed of care.
As causes, it has been suggested that the image management server did not have security software installed and that easily guessed (weak) passwords were in use, indicating that "places left thinly protected" at the department level can become entry points.
Ransomware defense needs an operational design that leaves no gaps, not one that starts "from whatever seems important."
[Case 6] Fukushima Medical University Hospital (December 2020)
At Fukushima Medical University Hospital, a cyberattack in December 2020 resulted in unauthorized access to the in-hospital network, affecting part of the system. (Reference: Fukushima Medical University Hospital, "On the Cause of and Countermeasures for the Computer Virus Infection")
This case confirms that ransomware response at medical institutions is not "fixed once and done."
The trigger has been attributed to a device that had been infected outside being brought into the hospital, reflecting the reality that managing devices and equipment brought in from outside tends to be a weak point on the ground.
[Case 7] QST Hospital (January 2024)
At QST Hospital, a ransomware attack in January 2024 brought down in-hospital systems and affected clinical operations. (Reference: On the Ransomware Damage to Systems on QST Hospital's Independent Network)
Even when patient care is not directly affected, ransomware damage grows when research, registration and integration systems stop.
According to the published information, a failure occurred in research-related systems, and information in the case-registration system became unavailable (about 475,000 case records could not be used).
The causes cited include network equipment software that had not been updated and reuse of the same password, basic management failures that show how a backlog of "updates and authentication," rather than "sophisticated attacks," can become the point of entry.
The necessary countermeasure is to bring asset management and access control up to the same standard across all systems, including peripheral ones.
What happens to a hospital hit by ransomware?
When a hospital is hit by ransomware, it is not simply a case of "the system broke."
When electronic medical records stop, care is restricted, and recovery takes far more staff and money than you might imagine.
Here we look at the impact on hospitals from five perspectives.
1. Clinical operations stopped or restricted
When electronic medical records become unavailable, staff have no choice but to revert to paper charts all at once.
Because the flow from reception through consultation, testing and prescriptions, normally connected by systems, is broken, confirmation work and transcription increase, and double-checks are needed to prevent errors.
As a result, waiting times grow and the number of patients the hospital can see falls. Depending on the situation, the hospital may be forced to restrict emergency admissions or postpone surgeries and tests.
The Handa Hospital case documents this kind of switch to paper-based operations as a real-world response, making it a case where you can concretely picture "what happens when things stop."
2. Huge recovery costs and lost revenue
What makes ransomware so frightening is not so much the moment things stop, but how "spending after the stop" snowballs. Recovery costs alone can reach tens of millions of yen.
You should understand the typical recovery costs and timelines.
In the Handa Hospital case, recovery-related costs were documented at just over about 70 million yen, with data recovery in particular accounting for a large share. On top of the costs of system rebuilding, investigation and outside support come overtime and other costs of on-the-ground response.
What makes things even harder is when restrictions on care continue. If restrictions on accepting patients and postponed tests and surgeries continue, lost revenue accrues, and securing alternatives requires outsourcing costs and additional staff.
Even with cyber insurance, there is no guarantee everything will be covered, and as a result the pressure on hospital finances is greater than you might imagine.
3. Risk of patient information being leaked
Today's ransomware does not simply encrypt data and stop things. Double extortion, adding "pay or we'll publish the stolen data" to "pay if you want it decrypted," is becoming the norm.
The hospital then has to assess, in a short time and in parallel with recovery work, "what was taken" and "how far the impact extends," which makes the response considerably heavier.
On top of that, external communication is unavoidable: explanations to patients and relevant organizations, handling inquiries, publishing recurrence-prevention measures and more.
In Japan as well, there have been cases of medical institutions disclosing the possibility of patient information leaks, showing that ransomware is both "a threat that stops clinical care" and "a threat that shakes trust."
4. Impact on public trust
Once news of a ransomware attack spreads through the media or social networks, the impact does not stay within the hospital.
Patients may worry, "Is it really safe?", which can lead them to avoid visits or transfer to other hospitals.
In recruiting, too, the hospital may be viewed with "is this a safe place to work?", and applications may fall.
In outsourcing contracts and joint research, the hospital may be asked to explain its recurrence-prevention measures and structure, which adds cost.
Even after systems are restored and care returns to normal, the reality is that regaining trust takes even more time and effort. Preparation in advance is indispensable against ransomware attacks.
5. Risk of legal liability and administrative guidance
The amendment to the Enforcement Regulations of the Medical Care Act clearly states as its background that cyberattacks targeting medical institutions are increasing and that such attacks can cause serious damage, such as stopping clinical care and theft of personal information.
In other words, administrators are expected to be prepared "on the assumption that attacks will happen."
Before the question of whether to install equipment even arises, hospitals without a proper structure and procedures are the ones least able to rebuild their systems when hit by ransomware, which magnifies the impact.
Who takes command, whom to contact, and what to prioritize? If the order of recovery and the flow of external communication have not been decided, you will be unable to answer when asked "so what did you actually have in place?" during on-site inspections or when called to account.
Putting your "structure, plans and operations" into concrete form in peacetime is, in the end, the best insurance.
To prepare in advance and be able to consult someone immediately when there are actual signs of an attack, we recommend first talking to a security company to understand your current risks.
[Now mandatory] What are the Guidelines for the Security Management of Medical Information Systems?
The Ministry of Health, Labour and Welfare (MHLW) has published the "Guidelines for the Security Management of Medical Information Systems," which set out the organizational structure, technical measures and day-to-day operational points needed to handle medical information.
Version 6.0 was released in 2023, making the key points for clinical settings more concrete.
Furthermore, with the amendment to the Enforcement Regulations of the Medical Care Act (in force April 2023), measures to ensure cybersecurity were positioned as a matter administrators must comply with, and defenses have entered a stage where they must be effective, not merely "recommended."
Overview of the guidelines and how they have been revised
These guidelines are a practical document that turns what it means to handle medical information "securely" into language that can be acted on in clinical settings.
The point is not only "confidentiality," preventing information leaks. They also cover "integrity," ensuring data is not tampered with, and "availability," ensuring care does not stop, organizing the thinking and operations clinical settings need.
Medical institutions have complex equipment configurations and workflows, and applying ordinary corporate security standards as-is often does not fit, which is why the guidelines have been revised repeatedly to match reality.
The latest Version 6.0 (released May 2023) reflects the string of real-world ransomware incidents and takes as its premise what should be prioritized.
Use it as the basis for your in-hospital rules and organizational structure.
Key measures the guidelines require
Here are five main items that hospitals should "put into concrete form first." The point is that none of them is "create once and done"; each must be set up so it actually runs as part of operations.
- Inventory of devices and systems that handle medical information (what is where / who manages it)
Identify "what exists in the hospital," covering not just electronic medical records but also imaging, laboratory, documents, appointments, endpoints and network equipment. Linking each to the person in charge, the vendor and the maintenance contract reduces missed updates and abandoned assets. - Backup design and protection (not just taking backups, but isolation and recovery drills)
Backups are meaningless if you merely "take" them. Design them to be isolated so they cannot be encrypted, and include regular tests of whether you can actually restore. If recovery procedures are vague, staff will freeze when it matters. - Network segmentation and access control (the boundaries between clinical / administrative / maintenance networks)
If boundaries are vague, attackers can move laterally all at once after an intrusion. Use configuration and permissions to make clear how far the clinical network extends and how maintenance connections are restricted. - Detecting, blocking and monitoring unauthorized traffic (a configuration that keeps no logs leaves you stuck when an incident happens)
Logs are the only material that lets you explain what happened. If logs cannot be collected or reviewed, you cannot investigate the cause or judge the scope of the impact, and recovery drags on. - Incident response plan (initial response, contact list, decision-making, external communication)
Decide "who takes command, what to prioritize and whom to contact." Having a plan that covers not only technical response but also patient handling and explanations to authorities and business partners lets you act without hesitation in the initial response.
On-site inspections and the checklist
The amended regulations clearly state "the need to improve effectiveness," so getting the paperwork in order is not enough.
What also matters is whether things are actually working on the ground and whether you can act when the time comes.
Examples of common sticking points in checklist compliance include: having no asset register and being unable to say immediately "what is where"; vendor maintenance paths being a black box, so no one knows who can get in from where; and taking backups but never running recovery drills, so there is "no guarantee you can restore."
To ensure your efforts are genuinely effective, you need fundamental security measures.
Ransomware defenses hospitals should implement
From here, we organize into four categories the "stumbling blocks" that come up again and again in real cases and "the order of defenses that work," as trends in survey data show.
On intrusion routes in particular, some surveys show results such as about 80% via VPN and RDP (National Police Agency report (2025)), so the first thing to tackle is not internal measures but the entry points (the places attackers can get in from outside).
If you keep adding products without securing these, the critical holes will remain.
We cover protection software for medical institutions in the article below.
Related: Best Ransomware Protection Software Compared (2026 Update): For Individuals and Businesses
Network and equipment measures
Trying to deal with everything at once tends to make the effort stall partway through. The realistic approach is to check the highest-priority areas first, then reach a state where measures are thoroughly in place.
- Inventory and update VPN appliances / perimeter devices (model, version, exposure, maintenance status)
Not knowing what you are using is the most dangerous state. Pin down the model and version, whether it is exposed to the internet, and whether maintenance is still active, then prioritize updates. - Strengthen authentication for VPN / remote maintenance (multi-factor authentication, strong passwords, no reuse)
Harden entry points on the assumption they "will be attacked." MFA is mandatory. Maintenance accounts must not be shared, and any exceptions are managed with an approval flow. - Close unnecessary public ports / stop exposing management interfaces / restrict source addresses
Simply "being open" makes you a target. Close what you don't use, and restrict sources even for what you need. As a rule, it is safest never to expose management interfaces to the internet. - Prohibit RDP in principle (if unavoidable, jump server + MFA + monitoring + restrictions)
RDP easily becomes an entry point, so the safest approach is basically not to use it. If it is truly necessary, put a jump server in between and run it together with MFA, monitoring, and restrictions on time of day and source. - Centralize log management (so you can trace "signs of intrusion" after the fact)
Logs are the material that lets you explain what happened. If logs are scattered or missing, you cannot trace the intrusion route or the scope of damage, and recovery drags on. Start by getting to a state where they are "collected and reviewable."
Backup measures
It is tempting to think that "having backups = being able to recover," but this is exactly where the pitfall lies. Attackers target not only production systems but also backups, the lifeline of recovery. That is why, with backups, "how you protect and restore them" matters more than "taking them."
- Keep multiple generations following the 3-2-1 approach (separate media and storage locations)
Design it so something survives even if one copy is destroyed. Without generation management, everything can be wiped out by being overwritten with encrypted data. - Always include offline / isolated copies (immutable storage, etc.)
Backups that stay connected to the network end up being hit along with everything else. Either physically disconnect them or build in a mechanism that prevents tampering and deletion. - Regularly test recovery procedures (prove that you "can restore")
Even if you take backups, if you have never restored from them, things won't work on the day. Testing and recording how many hours recovery takes and where it gets stuck supports decision-making when it counts. - Don't leave backup operations entirely to contractors (confirm responsibilities and procedures)
Make clear "who guarantees what, and to what extent." If the contractor's work is a black box, decisions are delayed when failures occur. You should check everything down to procedure manuals and communication lines.
Organizational and operational measures
In clinical settings, in the end it is "people and operations" that stop. No matter how much equipment and tooling you install, damage spreads the moment rules are vague, reports are delayed or decision-making stalls. That is why the realistic approach is to start by shoring up what works with the least effort.
- Security policy / exception procedures (rules for personal devices, USB drives and connecting to the hospital network)
"Prohibited in principle" alone does not work. Assume exceptions will arise and decide on the approver, connection method and how logs are kept, which reduces gaps in on-the-ground judgment. - Staff training (short and frequent): suspicious emails, passwords, reporting procedures
Running short sessions of 5 to 10 minutes frequently is more effective than one long annual training. It is especially important to drill in "who to report to when in doubt." - Incident response manual: the five initial steps, contact list, decision-makers
In the initial response, time spent hesitating is time wasted. Putting network isolation, not cutting the power, securing evidence, reporting and contacting experts on a single page makes it possible to act. - Drills (tabletop): including a "switch to paper operations" scenario assuming electronic medical records are down
Drills are not just for the security team. Confirming how clinical staff will "keep things running" greatly reduces confusion in a real incident. The key is to also review the procedure for switching to paper charts, role assignments and criteria for prioritizing care.
Managing vendors and contractors
Ransomware attacks via contractors are not something that "could happen in theory"; they actually happen. What matters here is less installing the latest products than whether contracts and operations can restrict "the conditions for getting in." Because the entry point lies with the contractor, the structure tends to allow holes to open where the hospital cannot see them.
- Method, authentication and device management for maintenance VPN / remote connections (who gets in, from where, and with what)
Not knowing the method, or being unable to identify the device, is dangerous. Decide the connection source, device, time window and scope of operations, and document them, including whether MFA is used. - Account inventory (abolish shared IDs, disable leavers, minimize privileges)
Review shared maintenance IDs as the top priority. If "live accounts" remain after personnel changes or departures, they become targets. Limit privileges to the minimum necessary. - Division of responsibilities in an incident (first response, reporting deadlines, evidence preservation, cost burden)
Disputes at the moment of an incident happen when responsibilities are unclear. Deciding who does the initial triage, by when reports are due, how logs and evidence will be preserved and who bears the costs speeds up decisions. - Write security requirements for contractors into contracts (MFA, patch management, device management, logs)
"Please do this" does not last. Only when the conditions to be met, such as mandatory MFA, patching deadlines, how devices are managed and how logs are submitted and retained, are written into contract clauses does the operation actually run.
Initial response if a hospital is infected with ransomware
The first few hours after an attack are a "fork in the road" that determines how far the impact on clinical care spreads and how hard recovery will be.
On top of that, the situation on the ground easily becomes chaotic, and even judgments you normally make with ease become clouded.
"Fixing the order" so people can act without hesitation makes it easier to stop the damage from spreading.
Taking the wrong action from the start can make things much worse. If you have any doubts, we recommend immediately contacting a security company's emergency consultation desk.
1. Cut off the network (top priority)
For any device suspected of infection, stopping lateral spread comes first.
Unplug the LAN cable, turn off Wi-Fi, and if possible shut down the switch port: focus first on "not letting it spread."
On the other hand, "shutting down everything" in the server room or core switches has an extreme impact on clinical care and tends to make it very hard to bring things back afterward.
The safe approach here is not to charge ahead on on-the-ground judgment alone, but to proceed in parallel while escalating the situation to the response headquarters (decision-makers) and to experts, including security companies.
If you misjudge the scope of what to stop, you may lose both containment of the damage and continuity of care.
2. Don't cut the power (to preserve evidence)
Carelessly rebooting or shutting down is dangerous.
In a ransomware investigation, information in memory, temporary files, execution traces, event logs and the like are clues for tracing when, from where and what was executed.
Cutting the power can erase or overwrite these, making it much harder to identify the cause and the scope of the damage.
The basic approach is to first isolate the device from the network to stop the spread, then keep endpoints and servers in their current state as far as possible so you are ready to follow experts' instructions.
3. Report to and notify the relevant parties
First, within the hospital, inform the head of information systems and executive management of the situation immediately, and set up a response headquarters as the place where decisions are made.
If individual departments start acting on their own, decisions about the scope of isolation, restrictions on care and external explanations will diverge, and things will spiral out of control later.
Next, consider external contacts in parallel. Contacting police consultation desks (cybercrime consultation) and relevant organizations, and filing any required notifications, gives you more options the earlier you do it. However, the basic rule for external communication is to organize "what we know" and "what we don't know yet" and align internally before acting.
Communicating while information is still confused makes regaining trust even harder.
4. Consult experts
Trying to recover on your own can actually spread the damage. Reinfection, destroying important evidence, and choosing the wrong restore point and bringing back a "contaminated state": these three pitfalls really do happen on the ground.
That is why it is safer to bring in emergency response / forensic support early.
Bringing in experts such as a security company to determine "where the point of entry was," "how far the infection extends" and "which recovery procedure is fastest" minimizes the impact on clinical care and leaves a record you can explain afterward.
5. Don't pay the ransom
As a rule, paying the ransom is not recommended. The reason is simple: there is no guarantee that "if you pay, you'll get it back."
The decryption key never arrives, it arrives but only part of the data comes back, or restored data still contains other malware and causes reinfection: such cases are not unusual in the field.
Furthermore, the very fact of paying can mark the organization as "one that pays," with the risk of repeat attacks or further extortion.
On top of that, it funds criminal groups, perpetuating a structure that fuels the next attack.
What matters is to prioritize isolation, evidence preservation, consulting the relevant organizations and expert support, and to calmly assess the realistic options for recovery.
For ransomware defense, CyberCrew's vulnerability assessments and penetration testing
As we have seen, ransomware damage at hospitals arises from a combination of "points of entry (especially VPNs and maintenance paths)," "authentication" and "operations (backups and drills)."
Statistics also show the reality of intrusion points: VPN and RDP are the main routes. In other words, closing off the "holes that let attackers in" before they get in is the most cost-effective defense.
Why vulnerability assessments and penetration testing are a ransomware defense
Looking at real cases, the same places are always targeted.
VPN appliances, contractors' remote connections, maintenance accounts: the paths that reach into the hospital from outside.
Once these are breached, attackers spread sideways inside the hospital, and the impact reaches electronic medical records and shared servers all at once.
That is why the starting point for defense is "creating a state where attackers cannot get in." Use vulnerability scanning and penetration testing to actually identify the entry points real attackers use, and close them in order, starting with the most dangerous.
Doing this alone can eliminate the "pre-intrusion stage" of ransomware with a high degree of probability.
Furthermore, this kind of effort also gives you grounds to say "we are doing this." In the context of the guidelines and the new obligations, what is being asked is effectiveness, not just formality.
Having a record that you identified what could become an entry point, prioritized it and made improvements is, on its own, strong material during on-site inspections and when you are called to account.
What sets CyberCrew's vulnerability assessments and penetration testing apart
Starting from a white-hat hacker's view of "where would an attacker look," CyberCrew prioritizes verification of the entry points that actually cause problems at hospitals (VPN / remote maintenance / contractor connections).
Rather than desk-based checks, we assess risk through the "flow that happens in reality," from intrusion → lateral movement → reaching critical assets, and assemble the material you need to move your defenses forward.
- We confirm whether a weakness is actually "exploitable" from the attacker's perspective
We verify not just whether vulnerabilities exist, but "whether they can really be breached" and "how far an attack can spread." We look at whether assets directly tied to continuity of care (around electronic medical records, authentication infrastructure, shared servers) can be reached, and judge by impact. - We don't stop at "finding": reports that convey the order of fixes
What troubles people on the ground is not so much the number of findings as "not knowing what to fix first." CyberCrew prioritizes by attack scenario and impact, and breaks things down, starting with the entry points to close right now, into improvement steps with minimal rework. - Support for hospital-specific issues, including operations and the division of responsibilities
VPNs and maintenance accounts cannot be solved by technology alone. We shape them into "operations that actually run," covering who gets in, from where and with what, MFA and device management, logs, emergency shutdown, and the division of responsibilities with contractors. - Output designed with the guidelines and accountability in mind
In practice, it is also important to put things in a form you can explain to executives, auditors and on-site inspectors. We show your current state and the rationale for improvements in light of the guidelines' perspectives (structure, technology, operations), in a form you can use for internal explanations. - An approach informed by our experience supporting medical institutions
Due to confidentiality obligations we refrain from naming names or giving details, but drawing on our experience assessing and supporting medical institutions, we propose realistic compromises premised on approaches that minimize the impact on care and on the constraints on the ground (replacement timing, maintenance paths, operational load).
Pricing and cost guide
Costs are not one-size-fits-all; they vary with the scope (public-facing assets, VPN / perimeter devices, the in-hospital network, critical servers, etc.), the duration and the depth of testing.
That is why CyberCrew never starts by saying "let's do everything." First, we spend a short time organizing the reality of your connection paths, the state of your asset inventory and your operational premises (how maintenance paths and permissions are held), and assess which entry point is the most dangerous.
We then work with you to settle priorities and scope so the work is effective even on a limited budget, and turn that into a quote.
In fact, ransomware recovery costs alone can reach tens of millions of yen. Seen that way, simply bouncing ideas off us about "what to do first" and settling on a scope that hits the mark without waste is, in itself, a move with a solid return on investment.
Frequently asked questions about ransomware attacks on hospitals (FAQ)
In this FAQ, we answer the questions that frequently come up from both clinical staff and management when hospitals consider ransomware defenses.
We have organized the points you need for decision-making, from the number of incidents to how to think about ransoms, recovery periods, insurance and the risks for small facilities.
Q. How many hospitals are hit by ransomware?
Ransomware incident reports continue in the medical and welfare sector as well, with reported figures cited as 20 cases in 2022 and 10 cases in 2023.
That said, these are only "the numbers that surfaced."
In reality, some cases may be handled without being disclosed or reported, so it is realistic to treat these numbers as "the tip of the iceberg."
Q. Should we pay the ransom?
As a rule, paying the ransom is not recommended.
Even if you pay, there is no guarantee the decryption key will arrive, and risks remain: only part of the data may come back, or you may be reinfected partway through recovery.
There is also the possibility of being seen as "an organization that pays" and being attacked again, and the unavoidable problem of funding criminal groups.
Q. How long does recovery take?
For a minor incident, operations can sometimes be restored within a few days to a few weeks.
However, when system rebuilding and data recovery are needed, it is a different story: investigating the cause, identifying the scope of infection, deciding on restore points and preventing recurrence all proceed in parallel, and recovery suddenly becomes long.
In the Handa Hospital case, too, rebuilding systems and recovering data took about two months, so it is safest to assume that hospital recovery will "take longer than expected."
Q. Should we get cyber insurance?
Cyber insurance is worth considering, because it can ease financial concerns such as outsourced incident response and investigation costs.
However, if basic measures such as updates, stronger authentication, backups and drills are insufficient, you may face less favorable terms for coverage or payouts, or the incident may fall under exclusions.
Insurance is "the last line of support"; the foundation is preparation in peacetime. The realistic positioning is not to fill gaps with insurance, but to use it to cover what remains after your preparations are in place.
Q. Are small clinics targeted too?
Even small clinics are not exempt.
The smaller the organization, the thinner operations such as updates, permission management, monitoring and training tend to be, and from the attacker's point of view it can become a target with a "high probability of success."
Ransomware is not a problem only for large hospitals; it is often described as causing damage regardless of industry or size.
That is why the realistic approach is to prioritize entry-point defenses, backups and minimum operating rules.
Summary
Hospitals face a combination of factors, strict uptime requirements (they cannot stop), the high value of medical information, a structure that tends to keep legacy environments in place, and staffing constraints, that make them an industry that easily becomes a major ransomware target.
Once hit, the reality is not just restricted care, but recovery costs ballooning into the tens of millions of yen. In the Handa Hospital case, recovery-related costs were documented at just over about 70 million yen, which makes clear how heavy the burden is "after things stop."
The priorities for defense are clear: the top priority is "measures against intrusion routes." Statistically, VPN and RDP tend to be named as the main intrusion routes, and updating perimeter devices, enforcing MFA and operational control of maintenance paths and contractor connections are the shortest path. Moreover, with the amended regulations in force from 2023, ensuring cybersecurity at medical institutions has become an area where "effectiveness," not "formality," is in question.
If you feel that "we've been told it's a closed network, but we're uneasy," "we don't have a handle on our VPN and contractor connections" or "we want to organize things in a form that will stand up to on-site inspections and accountability," the realistic first step is to inventory your entry points (VPN / maintenance paths / public-facing assets) and prioritize them. CyberCrew works from the attacker's perspective and, premised on a hospital's "can't-stop" reality, helps you organize everything down to the order of your defenses.
