When Ransomware Hits a Hospital: Recovery Starts with Resilient Cloud Storage

More than two months. That’s how long it took the University of Vermont Medical Center to get all 600+ applications back in full production after a ransomware attack in October 2020. Veteran physicians and nurses taught new graduates to chart on paper. Administrators ran lab results to providers on foot.

The attack was one incident in a problem that isn’t going away. According to The HIPAA Journal, healthcare data breaches affecting 500 or more people have held steady at 700 to 750 a year, about two a day. In 2025 alone, more than 61 million individuals had their protected health information (PHI) exposed or impermissibly disclosed.

Your security stack is built to keep attackers out. But any organization can be breached by someone with enough time and resources, so the better question is what happens next. The answer is settled long before an attack by how well your backups are protected and how quickly you can restore from them.

This post covers why healthcare remains a high-priority target, five things worth knowing before your next incident, and what storage looks like when the attacker already has your admin credentials.

Why healthcare is the ransomware industry's preferred target

Three things make healthcare a favorite target: the data it holds, the services it can’t pause, and the regulators watching how it handles both.

Healthcare data is uniquely valuable

Attackers know a good backup beats encryption. If you can restore, you don’t need to pay. So modern ransomware attacks commonly steal your data first, which gives attackers a second threat: pay, or the data goes public.

That threat carries weight because the consequences of losing the data are so severe, and PHI hurts more than almost anything. It’s sensitive, and it doesn’t expire. When a password leaks, you reset it. A diagnosis stays a diagnosis. That’s why PHI commonly commands premium prices on dark web markets, and why healthcare keeps landing on attackers’ lists.

Hospitals provide critical, time-sensitive services

A hospital can’t pause for a restore. Many procedures can’t wait, and when systems go offline or attackers lock patient records, a patient’s life or health can be at risk. The UVM Medical Center’s clinicians lived that reality when they went back to paper charts.

Attackers know it. Data theft now gets top billing, but encryption is still in the playbook, because without secure backups, paying the ransom may be the only way to get your data back. So attackers often find your backups and delete them early, to make paying the only way out.

HIPAA enforcement has intensified

Critical care and sensitive data are why healthcare is one of the most regulated industries, and enforcement shows it. In 2025, HHS’s Office for Civil Rights (OCR) resolved 21 cases with settlements or civil penalties, the second-highest count on record. Of those, 76% included a penalty for a missing or incomplete risk analysis. Regulators are looking at how prepared you were before the attack.

A ransomware attack can leave you paying twice: once to recover, and again to answer for how well you protected your data. The average healthcare data breach costs $7.42 million. The penalties are real: OCR collected $8.3 million across those 21 cases, ranging from $5,000 to $3 million.

The five things healthcare IT leaders need to know

Ransomware ranks among the biggest cybersecurity threats facing healthcare, and the traditional playbook isn’t keeping up.

1.    Prevention alone isn’t a strategy

Most security budgets lean toward stopping attacks at the border. That’s worth doing, but it can’t be the whole plan. A determined attacker will eventually find a way in, and attackers are increasingly using AI to speed that up. Assume the breach has already happened and design for it. Layer your defenses so an attacker who’s inside your network keeps running into walls.

2.    Backups are the primary target, not an afterthought

Before ransomware encrypts anything, attackers commonly look for your backups, and they destroy them if they can. If an attacker can reach a backup with a compromised admin credential, they’ll delete it. Offline, air-gapped, and immutable copies are the ones that hold up.

3.    The 3-2-1 rule needs two more numbers

The classic 3-2-1 rule says to keep three copies of your data on two types of media, with one copy offsite. It handles floods and fires. It doesn’t handle an attacker with your admin password.

The 3-2-1-1-0 rule adds two requirements: keep one copy immutable, offline, or air-gapped, and test every copy to confirm zero errors. Those two extra digits can decide whether you restore cleanly or open a negotiation.

4.    Speed of recovery is a clinical issue, not just an IT metric

How fast you restore affects patient care directly. Rehydration delays (waiting for archived data to become readable again), complex cold storage tiers, and slow restore processes all push back the day your critical systems return. Aim to restore from backups in hours rather than weeks, without paying the cold tier tax to get there.

5.    HIPAA compliance and cyber resilience are the same investment

HIPAA compliance depends on data retention, legal hold capabilities, versioning, access logging, and audit trails. Together, those controls largely come down to two jobs: keeping data available when it’s needed and knowing who accessed it, whether they were authorized or not.

Ransomware response and recovery need the same capabilities. One storage architecture that covers both HIPAA compliance and cyber resilience is typically cheaper and more effective than two standalone systems.

What cyber-resilient cloud storage architecture actually looks like

Cyber-resilient cloud storage protects your data even when an attacker is inside your environment holding admin credentials. Six features matter most:

• Immutability by design: Ransomware groups commonly try to corrupt or delete backups before they encrypt anything. Wasabi Object Lock and write once, read many (WORM) storage protect your backup data from encryption or deletion for the length of your retention period, even if an attacker holds admin credentials. You keep a known restore point.

• Air-gap and isolation: Ransomware moves laterally through your network to reach other devices and backup systems. Wasabi Covert Copy™ keeps a logically air-gapped copy of your backup data out of sight. An attacker with compromised credentials or physical access can’t see it, so they can’t encrypt or delete it.

• Multi-user control for destructive actions: Multi-User Authorization requires a second approval for sensitive administrative actions. One compromised admin account can’t remove critical protections or expose a Covert Copy on its own.

• Rapid recovery without the cold tier tax: Hyperscaler storage often forces you to choose between fast access and low cost. Wasabi Hot Cloud Storage gives you instant access to backup data, with no rehydration delays, retrieval fees, or complex tiering.

• Governed and auditable: HIPAA compliance depends on retention policies, legal holds, versioning, and access logging. These built-in controls support compliance, and after an incident they help you determine the scope of the attack and prove compliance to regulators.

• Cost-certain scale: More copies, longer retention, and wider geographic spread all make you more resilient. Predictable pricing with no egress fees lets you keep multiple backups and run full-scale disaster recovery (DR) tests without watching the bill.

What healthcare organizations using this architecture say

“Ransomware is a major concern in the healthcare industry. Having offsite copies in immutable and affordable Wasabi hot cloud storage is critical for our day-to-day efforts and peace of mind. Wasabi’s Object Lock is a game-changer.” — Kyle Burnette, Director of IT Infrastructure & Security and HIPAA Security Officer, BrightStar Care

“We have healthcare data going back to the 1990s that we’re required to keep. Our backups were taking a full weekend.  We needed a solution that would not only help us affordably archive all our old data at a separate location but also ensure that the data is easily accessible any time a doctor or somebody has to pull a file, from whatever year. We found what we needed with Wasabi and Komprise.” — Kevin Rhode, Chief Information Officer, District Medical Group

“It did everything we needed to do, it’s easy to use, cost- effective, and the immutability is a huge selling point. For what we pay for Wasabi, I feel like we get more storage and better support when needed than anything I’ve used in the past.” — Tom Herrold, Director of IT, Hospice of the Piedmont 

A practical action plan for healthcare IT

Perimeter defenses can’t carry the whole load against ransomware. Here’s how to find out where your backup architecture stands, and what to do about it.

Deepen your understanding first

Before you change anything, find where your current setup falls short. Three checks will show you the gaps, and where you might save money:

• Audit your current backup architecture: Check it against the 3-2-1-1-0 framework. Specifically, verify that an immutable or offline copy exists and that a compromised admin account can’t access or edit it.

• Test your recovery time: Run a full-scale DR test, or review your most recent one, and see how long recovery took. Then ask whether that’s fast enough to meet operational requirements and for the patients who depend on those systems.

• Examine your investments: HIPAA retention policies and cyber resilience plans often overlap heavily. Check whether one system covers both or you’re paying for two.

Test before you need it

Don’t let recovery from a real ransomware attack be the first test of your backups. Two drills help:

• Simulate ransomware recovery: Run a mock recovery against your backup environment and restore at meaningful data volumes. This checks the “0” in 3-2-1-1-0 (zero errors) and shows you where the plan breaks while the stakes are low.

• Perform a health check: Use Wasabi’s Security Dashboard to review your security posture. The Health Check feature flags configuration gaps so you can fix them before an attacker finds them.

Take action

Strong security and HIPAA compliance both depend on storage that makes resilience affordable at scale. Two things to check:

• Verify storage capabilities: Look for immutability, air-gap capabilities, rapid access, auditability, and data retention. Confirm your storage provider supports a 3-2-1-1-0 plan.

• Count the cost of resilience: Hyperscaler cold storage keeps storage fees low, but you pay for it in slower access and egress fees. Calculate what it would cost to keep multiple backup copies and to restore everything after a ransomware attack.

Building storage architectures for cyber resilience

Ransomware will keep testing healthcare, and some attacks will get through. What decides the outcome is what’s waiting on the other side: a clean, immutable copy of your data, a recovery you’ve already rehearsed, and a bill you saw coming. With those in place, you restore on your own schedule. Without them, you negotiate on the attacker’s.

That’s what healthcare teams use Wasabi for. Wasabi Hot Cloud Storage includes immutability, Multi-User Authorization, and object replication at no additional cost, so protection isn’t a line item you have to defend. There are no egress fees or API request charges, so a full-scale restore test doesn’t come with a surprise invoice. It also works with the backup tools your team likely already runs. A small IT team can get there without a cloud specialist on staff.

Knowing where you stand is the first win. Your next move can be small. Audit your backups against 3-2-1-1-0, schedule a restore test, or price out what resilience would cost you. If you’d like a second set of eyes, Wasabi’s storage experts work with healthcare IT teams on exactly this.