Executive Summary

The Qilin ransomware group has claimed 168 attacks against healthcare organizations in the last 18 months, positioning itself as the leading active threat against hospitals, according to leak site data analysis published by Recorded Future and SecurityScorecard researchers. The figure surpasses LockBit (partially disrupted in 2024) and BlackCat/ALPHV in victim volume in the healthcare sector.

Qilin operates as Ransomware-as-a-Service (RaaS) with affiliates paying 15-30% of the ransom. Their tactics include prior exfiltration (double extortion), direct negotiation with patients (publishing sensitive data on forums), and dwell times of up to 6 weeks before encryption.

Key Points

  • 168 confirmed victims in healthcare: hospitals, health systems, insurers, medical technology vendors
  • Geography: US (40%), Europe (30%), Asia-Pacific (20%), LatAm (10%)
  • Main vector: phishing + exposed RDP/VPN credentials (60% of cases)
  • Average ransom demanded: $2.5M per medium victim
  • Average dwell time: 38 days between initial access and encryption

Regulatory Implications

HIPAA: §164.404 (notification to individuals) and §164.408 (notification to media) obligations apply. Paying the ransom does NOT exempt from notification.

NIS2: Report incidents with continuity impact <24h (early warning) and <72h (incident notification). Ransom payment must be reported.

GDPR: If EU patient data is exfiltrated, notify relevant DPA within 72h. DPAs have fined European hospitals for delays in notifying ransomware breaches.

Recommendation

  1. Immediate audit of RDP/VPN exposure: any internet-accessible server with PHI is an entry vector. Implement Zero Trust Network Access (ZTNA).
  2. Clinical network segmentation: PACS, HIS, EHR in separate VLANs without direct internet access.
  3. Exfiltration detection: DLP focused on PHI, monitor outbound flows >X MB.
  4. Immutable offline backup: 3-2-1 rule with at least one air-gapped copy. Modern ransomware attacks backups before encrypting.
  5. Threat intelligence: subscribe to vertical-specific (healthcare) feeds rather than generic ones. Qilin changes TTPs every 6-8 weeks.

Source: Becker’s Hospital Review - Qilin ransomware healthcare victims

This analysis is part of HealthSec, the weekly briefing on healthcare cybersecurity.