The quarterly report highlights a record number of ransomware attacks alongside growing threats from cybercriminals targeting healthcare organizations through stolen login credentials.

Ransomware attacks against the global health sector hit a record high in the third quarter of 2026, with 317 events impacting healthcare organizations, according to the latest Health Sector Heartbeat report from the Health Information Sharing and Analysis Center (Health-ISAC).

The quarterly threat brief, released Oct 21, found that the health sector accounted for 9.72% of the 3,260 ransomware events identified across all critical infrastructure sectors in Q3 2026—a notable jump from the historical average of 7.5%. Since 2020, Health-ISAC has tracked 2,607 breaches in the health sector, representing 6.72% of the 38,806 total breaches recorded across all sectors.

Health-ISAC also highlights a rise in attacks involving ShinyHunters, a data-theft and extortion group that uses domain impersonation and voice phishing to steal organizational login credentials. The report identifies the group’s campaigns as a major contributor to the overall increase in cybersecurity incidents.

ShinyHunters: An Identity-Focused Threat

Unlike traditional ransomware operators, ShinyHunters does not typically encrypt files. Instead, Health-ISAC assesses the group as an identity and SaaS-access extortion operation that steals data at cloud scale and threatens publication to pressure victims into paying.

The group’s attack chain begins with reconnaissance on target employees, followed by phone calls that spoof known organizational numbers. Operators impersonate internal IT support and pressure victims to visit look-alike login pages—often on personal mobile devices outside corporate security controls. Reverse-proxy phishing kits relay credentials to the real login portal in real time while callers coach victims into providing active MFA codes or approving push notifications. Helpdesks are also targeted directly to obtain MFA resets, device enrollment, or password resets, according to the report.

Once attackers hold an authenticated session, the single sign-on platform—Microsoft Entra, Okta, or Google—becomes their control plane. From there, they pivot into connected SaaS applications such as Microsoft 365, SharePoint, and Salesforce to rapidly exfiltrate data, according to the report. Recent campaigns have used domains impersonating victim login portals in patterns such as company-claims[.]com and company[.]claims, with some medical-themed variants.

In an Aug 28 alert, Health-ISAC reported vishing campaigns against multiple member organizations over the preceding two weeks, with the scope expanding across business units. Because exfiltration is rapid and encryption is not required, victims may report limited operational impact while still facing substantial exposure of protected health information, personally identifiable information, and organizational data.

Record Quarter for Targeted Alerts

Health-ISAC sent 647 targeted alerts to member organizations in Q3 2026—a record-breaking quarter. Primary threat themes included ShinyHunters credential-phishing domains and zero-day exploitation in internet-facing edge devices, specifically Citrix NetScaler and Check Point products.

In September, Citrix confirmed two actively exploited vulnerabilities in NetScaler ADC and NetScaler Gateway. CVE-2026-88771 is a remote code execution flaw caused by improper input validation, while CVE-2026-88772 is a memory overflow in the appliance’s DTLS handling. Both carry a CVSS score of 9.5, and DTLS is enabled by default on VPN virtual servers. Palo Alto Networks Unit 42 observed reconnaissance in late August and web shell deployment from early September, and counted roughly 50,000 potentially vulnerable internet-exposed instances. Because attackers established persistence through web shells, patching alone may not remove an existing compromise.

Check Point disclosed two additional critical vulnerabilities on Sept 22, each with a CVSS score of 9.8 and neither requiring authentication. CVE-2026-85102 is a remote code execution flaw in VPN certificate handling, and CVE-2026-93616 is a path traversal flaw in the Management web service that allows attackers to upload and run scripts. CISA added both to its Known Exploited Vulnerabilities catalog with a Sept 25 remediation deadline.

Underground Forum Activity

Health-ISAC also tracked multiple ransomware groups listing health sector victims on data leak sites during the quarter:

  • On Aug 27, the DireWolf ransomware group claimed a US nonprofit supporting the organ donation and transplant community as a victim, alleging possession of 253 GB of stolen data including medical records, financial documents, and personal information.
  • In July, the Qilin ransomware group claimed two health sector victims: a medical testing laboratory and a private emergency medical services and healthcare transportation provider.
  • On July 18, the Pear ransomware group claimed a federally qualified health center in the southwestern US as a victim, alleging theft of 1.4 TB of data.

Mitigation Recommendations

Health-ISAC recommends health sector organizations deploy phishing-resistant multifactor authentication using FIDO2/WebAuthn keys or passkeys for administrators, help desk staff, and executives, and disable SMS and voice MFA fallbacks. The organization also recommends:

  • Requiring verified callback and strict identity checks for MFA resets, with no same-call resets
  • Blocking .claim and .claims domains unless legitimately needed
  • Monitoring for bulk downloads, API anomalies, OAuth consent changes, and MFA reset events
  • Restricting SaaS access to corporate-managed devices
  • Separating administrator accounts from daily-use accounts
  • Maintaining token and session revocation playbooks and pre-staged SaaS containment steps

For the Citrix NetScaler vulnerabilities, Health-ISAC advises members to apply the fixed builds immediately, hunt for unexpected files and suspicious sessions, and isolate any appliance that may be compromised while preserving logs and snapshots before rebuilding. For the Check Point flaws, Health-ISAC recommends applying the vendor’s LivePatch or Jumbo Hotfix updates and updating Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968 or later; where patching is delayed, it advises restricting VPN traffic (UDP 500 and 4500) to known peer addresses and reviewing Check Point’s published indicators of compromise.

“The key is to treat the identity provider as the control plane and defend it accordingly,” according to the Health-ISAC report.

ID 481459107 © BiancoBlue | Dreamstime.com