Add us as a preferred source
Carole Reeves, director of security operations at digital transformation specialist ANS, explains why ransomware resilience starts before an attack.
When ransomware disrupts healthcare systems, the impact reaches far beyond IT. Diagnostic tests can be delayed, appointments postponed and treatment plans disrupted. Clinical teams may be left without access to the systems they rely on, while patients are left waiting for care.
That is why ransomware resilience in healthcare cannot be measured by whether technology is eventually restored. The real measure is whether essential care can continue safely while an organisation responds and recovers.
Ransomware attacks typically involve criminals encrypting an organisation’s data or systems to prevent access. In many cases, attackers also steal sensitive information and threaten to publish it unless a ransom is paid, increasing the pressure on healthcare providers to respond quickly.
The 2024 attack on Synnovis, a pathology services provider supporting healthcare organisations in South East London, demonstrated the potential impact. More than 11,000 outpatient appointments and elective procedures were delayed, highlighting how disruption to a critical service can affect patient care across multiple organisations.
The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 33% of health and social care businesses had identified a cyber security breach or attack in the previous 12 months, compared with 43% of businesses overall. Although these figures cover a range of cyber threats rather than ransomware alone, they underline the need for strong preparation and response.
For healthcare providers, resilience means being able to contain attacks, recover critical systems and maintain essential services while recovery is under way.
Resilience starts before an attack
No security strategy can guarantee that an organisation will never experience a cyber incident. Healthcare providers must therefore plan for disruption and understand how they will continue operating if critical systems become unavailable.
This starts with identifying the systems and data essential to patient care, understanding their dependencies and assessing the consequences of an outage. Disruption to pathology services, for example, can delay diagnostic decisions and affect treatment plans even when other systems remain operational.
Healthcare organisations also need to understand where they rely on third parties. Suppliers, laboratories, cloud platforms and connected services can all become part of the clinical risk picture. If one critical service is unavailable, the impact can move quickly across multiple teams and organisations.
Four areas are particularly important to building ransomware resilience in healthcare: secure backups, prioritised recovery, tested incident response and early threat detection.
Backups are fundamental to ransomware recovery, but their effectiveness depends on whether they remain accessible and trustworthy during an attack. Cyber criminals may attempt to compromise or delete backup copies before encrypting production systems, making recovery significantly more difficult.
Immutable backups help address this risk by preventing data from being altered or deleted for a defined period. Healthcare organisations should identify the information that requires protection, isolate backup copies appropriately and regularly test whether data can be restored successfully.
Backups alone, however, are not enough. Organisations also need to understand how long restoration will take, whether recovered data can be trusted and which services need to return first. A backup that cannot be restored within an acceptable timeframe offers limited reassurance during a live incident.
Recovery must reflect clinical priorities
Restoring a system is not the same as restoring a clinical service. Healthcare organisations need recovery plans that prioritise services according to patient safety, clinical urgency and the dependencies between systems.
Recovery time objectives and recovery point objectives help establish how quickly systems must return and how much data loss can be tolerated. These targets should reflect clinical and operational requirements, rather than being based only on technical considerations.
Plans must also account for alternative ways of working. Clinical downtime procedures should explain how staff can access essential information, communicate decisions and maintain services safely while digital systems are unavailable. These arrangements must be practical, understood by the people expected to use them and regularly reviewed.
When ransomware strikes, teams may need to make urgent decisions with incomplete information while clinical services face pressure to maintain care.
A tested incident response plan helps reduce uncertainty. It should establish who makes key decisions, how security teams coordinate with clinical leaders, when systems should be isolated and how staff, patients and external partners will be informed.
This is particularly important in healthcare because technical containment decisions can have clinical consequences. Isolating a system may reduce the spread of an attack, but it may also affect access to information or services needed for patient care. Those decisions need to be made quickly, but they also need the right clinical and operational context.
Tabletop exercises can help teams work through realistic scenarios, from a compromised supplier to the loss of a critical clinical system. Involving clinical and operational leaders alongside IT and security specialists ensures response decisions account for patient safety and the practical challenges of delivering care during disruption.
Exercises should also identify gaps in responsibilities, communications and recovery arrangements, allowing organisations to address weaknesses before an actual incident exposes them.
Detecting threats before they spread
The earlier an attack is identified, the greater the opportunity to contain it before more systems are affected. Healthcare environments can be complex, with legacy infrastructure, connected devices, third-party services and systems that cannot easily be taken offline.
Continuous monitoring and effective threat detection can help security teams identify suspicious activity and respond before the damage escalates. Managed detection and response services can provide specialist expertise and monitoring outside standard working hours.
However, detection is only effective when alerts reach the right people and clear processes enable them to act. An alert only has value if someone has the authority, context and route to respond. Security teams need established escalation routes, an understanding of critical systems and the ability to take appropriate action when a threat emerges.
Ransomware resilience requires collaboration between security specialists, clinical leaders, operational teams and external technology partners. Everyone involved needs a shared understanding of which services must be protected and how essential care will continue during disruption.
For healthcare, the objective is not simply to recover systems. It is to protect patients, support clinical teams and maintain safe services under pressure.
Preparing for that challenge before an attack occurs is fundamental to protecting the care people depend on.
