The was an editorial in the journal of The Lancet published by Oscar Freyer et al in January, 2026 titled “Are we heading towards a cybersecurity crisis in health care and are actions needed?.” The article is attached in PDF format for your information, and below is a summary for your convenience.
Over the past 10 years, there has been a substantial rise in the number of major cyberattacks on hospitals, medical infrastructure, and associated supply chains. The WannaCry ransomware attack hit the UK’s National Health Service in 2017, affecting 34 hospitals, bringing global attention to the vulnerabilities of health-care digital security. In 2024, the Change Healthcare cybersecurity incident impacted the US health-care system, causing financial losses worth billions of US dollars, while a cyberattack in France on a health insurer compromised the data of more than 33 million people. These events, occurring across diverse health-care systems point to shared structural weaknesses, exposing millions of patients’ data, jeopardizing patient safety, and causing financial losses. Rapid digitization is causing these threats to evolve in complexity and grow exponentially in their frequency and impact.
Rapid digitization and the increasing use of innovative technology have resulted in cybersecurity becoming a key priority, with health care now being widely recognized as a high-risk sector requiring robust cyber measures such as network segmentation, real-time anomaly detection and response systems, and operational redistribution strategies to maintain continuity during widespread cyberattacks. Health-care infrastructure remains vulnerable due to its outdated information technology systems, legacy cyber-physical systems, poorly cyber-aware staff, and financial resource constraints. These risks are poised to become even more pronounced with the increasing adoption of emerging digital care delivery models, such as hospital-at-home services, artificial intelligence-driven clinical decision support systems, and the Internet of Medical Things.
According to IBM’s Cost of a Data Breach Report 2023, health care had the highest average breach cost compared with all other industries for the 13th year in a row at US$10·93 million, nearly double the global average. Although health care accounted for just 5% of incidents, it remains highly targeted due to sensitive data, operational demands, and outdated systems. These issues highlight persistent security gaps and the need for stronger regulatory action. In response, both the EU Commission and UK Government have introduced new cybersecurity initiatives to protect health-care infrastructure from escalating threats.
To ensure meaningful change, stakeholders should prioritize crucial health-care infrastructure and secure consistent funding for impactful cybersecurity measures to enable health-care providers to take responsibility of protecting patient data and digital health systems. This objective can be ensured by raising awareness and knowledge among stakeholders and establishing a stronger culture of compliance supported by clear accountability measures for health-care organizations and device manufacturers. Such accountability measures include financial penalties for failure to comply with data protection requirements, mandated breach notification within 72 h, and cybersecurity audits, or certification requirements. Further attention is also needed for securing cyber-physical systems and medical devices, which remain particularly vulnerable components within the health-care ecosystem.
The high-level policy initiatives are essential for setting guardrails, but the focus on policy compliance could foster a checklist mentality in which health-care organizations direct finances towards meeting the bureaucratic requirements. Instead, policy initiatives should enable these organizations to implement a strong cybersecurity culture to ensure that additional funds are spent for meaningful activities. Policy makers should not only set the guardrails but also pave the road for secure digital health care to thrive.