October is Cybersecurity Awareness Month
Throughout the month we have taken on cybersecurity subjects that continue to be challenging in healthcare today. Continuing our awareness campaign, we have rounded up some reports and resources from around the industry that are focused on privacy, security, and cyber issues.
Featured Report
ThreatLabz 2026 Phishing and Initial Access Report
In-depth research into how attackers exploit trust, exposure and identity
In this report, you’ll discover:
- Phishing is declining in volume, but concentrating in fewer, higher-conversion campaigns that blend into trusted workflows and sectors
- AI is accelerating both realism and velocity, enabling polished lures and rapid infrastructure spin-up and rotation
- Encryption provides the default cover for initial access and limits what teams can detect without TLS visibility
- Deception brings early attacker intent into view, exposing scanning, probing, and credential validation before access is established
- Practical steps to eliminate initial access risk, including attack-surface reduction, stronger identity controls, and earlier takeover detection
More Cyber Reports and Resources
Security Risk Assessment Tool
The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires that covered entities and its business associates conduct a risk assessment of their healthcare organization. A risk assessment helps your organization ensure it is compliant with HIPAA’s administrative, physical, and technical safeguards.
Your Complete Guide to SMS Compliance in the US
This guide explains what SMS compliance is and covers essential SMS regulations businesses must follow in the United States. SMS compliance refers to adhering to legal requirements set by regulatory bodies like the FCC, TCPA and CTIA when sending text messages to customers.
H1 2026 Healthcare Data Breach Report
The HIPAA Journal released analysis of the 2026 healthcare data breaches reported to the US Department of Health and Human Services (HHS) Office for Civil Rights. It notes a year-over-year reduction in breaches. However, in the first six months of 2026, large healthcare data breaches were reported at a rate of more than 2.2 per day. All but two of the top twenty data breaches were due to hacking incidents or ransomware attacks, and nine reported that more than 1 million individuals were affected. The largest breach affected more than 5.8 million individuals.
2026 Healthcare IT Landscape Report
This finding anchors Omega Systems’ 2026 Healthcare IT Landscape Report, which surveyed 200 C-suite executives, IT leaders, and practice administrators across independent and mid-market healthcare organizations. The results reveal a sector navigating compounding pressure: a widening third-party attack surface, an accelerating fatal-incident trajectory, a compliance environment that has run out of flexibility, and an AI opportunity that most practices cannot yet safely capture.
Annual Threat Report: Health Sector 2026
The report features data-driven insights from the Health-ISAC Ransomware Events Database, Physical Security assessments, and the Targeted Alerts initiative, which distributed more than 1,200 warnings to the sector in 2025. These findings showcase the community-felt impacts of major threats, including the rise of AI-driven attacks and significant supply chain vulnerabilities.
MedTech Security Baselines
This paper identifies a practical set of baseline cybersecurity capabilities that Healthcare Delivery Organizations (HDOs) commonly expect Medical Device Manufacturers (MDMs) to support. Its purpose is to promote alignment during product evaluation, procurement, and intake processes while recognizing that not all medical devices can natively implement every security control in every deployment scenario.
Health Sector Heartbeat
Health-ISAC’s 2026 Second Quarter (Q2) Health Sector Heartbeat provides observations of ransomware, cybercrime trends, and malicious actor forum postings that could potentially impact health sector organizations. This product is for your situational awareness, and Health-ISAC recommends that members affiliated with the victim companies or those potentially affected take appropriate measures to secure critical infrastructure.
Managing Exposure at AI Scale
AI is changing the exposure equation from both directions. Development teams can create and modify software faster, while security tools and researchers can discover vulnerabilities faster. New research among 200 senior security and technology leaders shows that the biggest challenge is no longer simply finding more exposure. It is continuously adding context, deciding what matters, and moving from discovery to action fast enough to reduce risk.
The State of Compliance
An ongoing quarterly empirical review of U.S. healthcare breach activity — drawing on OCR, state attorney general filings, CISA advisories, and primary entity disclosures. Each issue tracks vendor concentration, disclosure quality, attack archetypes, and regulatory movement across the quarter.
Unveiling Patient-Level Harms and At-Risk Clinical Groups During Hospital Cyberattacks
Cyberattacks against health care organizations are rising in frequency and shifting in nature from data theft to intentional denial of care. This systematic review identifies and characterizes patient-level harms occurring during hospital cyberattacks across international settings, determines which clinical populations are most vulnerable, and compares patient-level harms reported in peer-reviewed case studies with those described in patient and provider narratives on social media.
Cybersecurity Hygiene in Health Care: Practical Steps for Clinicians to Protect Themselves and Their Organizations
Cybersecurity has become a critical determinant of patient safety, business continuity, and organizational resilience in health care. Health care organizations are increasingly targeted by ransomware, data theft, and related attacks that disrupt clinical operations, threaten patient safety, delay care, and compromise sensitive information. Although often viewed as technical failures, many incidents originate in routine human behaviors, including phishing responses, credential misuse, unsafe downloads, and inappropriate use of personal devices or applications. This review focuses on clinician-level actions that can reduce both personal and organizational risk, including strong and unique passwords, multifactor authentication, phishing recognition and reporting, timely software updates, secure network use, careful management of personal devices and apps, and avoidance of risky removable media or untrusted downloads. It also emphasizes preparedness for extended network downtime, including familiarity with business continuity processes for documentation, ordering, communication, and care coordination when core digital systems are unavailable.
Healthcare Cybersecurity: Risks, and Defenses
Healthcare cybersecurity protects patient data, clinical systems, and connected medical devices from cyberattacks that disrupt care and expose protected health information. It carries a weight no other sector shares, because when a hospital’s systems go down, the consequence is measured in delayed treatment and patient risk, not only in dollars.
The figures reflect those stakes. A healthcare breach cost an average of $7.42 million in 2025, the highest of any industry for the fourteenth year running, according to IBM’s Cost of a Data Breach Report. That same year, the sector was still absorbing the Change Healthcare attack, which exposed the records of roughly 192.7 million people.
This guide covers why cyberattacks on healthcare institutions endanger patients, what makes medical records so valuable, the threats and the landmark breach that define the field, the rules that govern health data, and how providers can defend themselves.
