Ransomware in Healthcare: How Attacks Start and What Staff Can Do
How ransomware gets into hospitals, GP practices and care homes, the everyday habits that stop it, and exactly what to do if your screen locks with a ransom note.
Ransomware in healthcare almost always starts with something small: a phishing email, a stolen or guessed password, or a system that has not been updated. Staff can stop many attacks with everyday habits such as reporting suspicious messages, using multi-factor authentication and saving work where it is backed up. If your screen ever locks with a ransom demand, disconnect from the network, do not engage with the message, and call IT straight away.
Why ransomware hits healthcare so hard
Ransomware is malicious software that locks or encrypts files and systems, followed by a demand for payment. Many groups now also steal data before encrypting it, then threaten to publish it, which the National Cyber Security Centre Ireland (NCSC Ireland) describes as "double extortion". In a hospital, GP practice or care home, locked systems mean lost access to records, results, rotas and prescribing, so the harm reaches patients quickly.
The impact can come through a supplier, too. After the June 2024 ransomware attack on Synnovis, a pathology provider to hospitals and GP services in south-east London, more than 10,000 acute outpatient appointments and 1,704 elective procedures had been postponed at King's College Hospital and Guy's and St Thomas' by early September (NHS England London, September 2024). For Ireland's largest health-service incident and the organisational lessons from it, see our post on lessons from the 2021 HSE cyber attack. This post looks at the part staff play day to day.
How ransomware gets in
NCSC Ireland's ransomware guidance describes three main routes in. Each has a staff angle.
Phishing
An email tricks someone into opening a malicious file, clicking a link, or entering their login details on a fake page. The HSE attack began this way: a malicious Excel attachment opened on one workstation on 18 March 2021 (PwC independent post-incident review for the HSE, December 2021).
Stolen or guessed passwords
Attackers log in using credentials taken through phishing, leaked in other breaches, or guessed. A password you reuse for a personal shopping account can become a way into a work system if that site is breached.
Unpatched systems
Attackers exploit known weaknesses in internet-facing systems such as remote access gateways and remote desktop services. The UK National Cyber Security Centre (UK NCSC) notes that ransomware is increasingly deployed by attackers who gained remote access through exposed services. Most of this sits with IT, but the "restart to install updates" prompt on your own device is part of it.
The quiet phase
Ransomware is rarely instant. Once inside, attackers move between systems, look for higher-level accounts and try to disable protections before encrypting anything. In the HSE's case, the ransomware was not set off until 14 May 2021, nearly two months after the email was opened, and the independent review found missed opportunities to spot the activity in between. That gap is why reporting something odd early is so valuable.
Everyday habits that stop ransomware
| Habit | Why it helps |
|---|---|
| Report suspicious emails and texts, even after deleting them | Lets IT block a campaign before someone else opens it |
| Do not "enable content" or macros on unexpected documents | Malicious spreadsheets and documents often need this to run |
| Use a unique password for work and turn on multi-factor authentication (MFA) | A stolen password alone is no longer enough to log in |
| Only approve sign-in prompts you started yourself | Attackers send repeated prompts hoping you tap "approve" |
| Restart promptly when updates are waiting | Closes known weaknesses attackers look for |
| Save work to approved shared drives or cloud storage, not the desktop or a USB stick | Approved locations are usually backed up, so data can be restored |
| Use only approved software and devices | Unapproved downloads and personal USB sticks bypass security checks |
| Lock your screen and never share logins | Shared accounts make it hard to spot misuse and contain an attack |
NCSC Ireland recommends an authenticator app rather than text messages as the second factor where possible, and backups following the 3-2-1 approach: three copies, on two separate systems, with one kept offline. You do not run the backups yourself, but you decide whether your work ends up somewhere that is backed up.
Warning signs to report
- Files you cannot open, or files with strange new extensions
- New text or web files appearing in folders with names like "README" or "how to recover"
- Your antivirus switching itself off or showing unfamiliar alerts
- A device that is suddenly very slow, or a mouse moving on its own
- Several colleagues reporting the same oddity at once
None of these is proof of ransomware, but each is worth a quick call to IT.
What to do if your screen locks with a ransom note
- Do not interact with the note. Do not click links in it, contact the attackers or try to pay. Law enforcement does not encourage paying ransoms, and payment does not guarantee you will get data back (UK NCSC).
- Disconnect from the network. Unplug the network cable and turn off Wi-Fi. The US Cybersecurity and Infrastructure Security Agency (CISA) advises isolating affected systems immediately and powering them down only if you cannot disconnect them (CISA Ransomware Response Checklist). If your organisation's plan says otherwise, follow your plan.
- Call IT by phone. Use the service desk or out-of-hours number, not email from the affected device.
- Note what you saw. The time, what you were doing, and a photo of the screen taken on another device.
- Switch to downtime procedures. Patient safety comes first. Use your paper or business continuity processes and tell the person in charge of the shift.
- Do not try to fix it yourself. Avoid plugging in USB drives, restoring files or restarting repeatedly.
Your organisation will handle formal reporting. In Ireland, NCSC Ireland advises reporting ransomware to An Garda Síochána and to incident@ncsc.gov.ie; in the UK, incidents go to Report Fraud and the UK NCSC. Personal data breach notification to the Data Protection Commission or the Information Commissioner's Office (ICO) may also be needed. For how providers should plan for this, read our guide to data breach and cyber incident response for care providers.
Frequently asked questions
Will paying the ransom get our systems back?
There is no guarantee. Both the UK NCSC and law enforcement warn against relying on payment, and the decision is always an organisational one, never something an individual member of staff should attempt.
Is it my fault if I opened the email that started it?
Attacks are designed to fool busy, careful people. What matters most is reporting quickly and honestly. Organisations recover faster when staff feel safe to speak up.
Should I switch my computer off?
Disconnect it from the network first. Only power it down if you cannot disconnect it, or if IT or your incident plan tells you to, because a running machine can hold evidence investigators need.
If we have backups, do I still need to worry?
Yes. Backups help with recovery, but attackers often target them and may already have stolen data. Preventing the attack in the first place is still far better.
Ransomware prevention is mostly a collection of small, repeatable habits. If you want to build those habits across your team, explore Learnsignal's healthcare compliance CPD courses.
This page was last updated:
Learnsignal Education Team
Expert Tutor at Learnsignal
Qualified professional with years of experience helping students advance their professional careers.
View all posts by Learnsignal Education Team
