How adversary tradecraft propagates from initial access to clinical-service-line impact · Three primary vectors: Ransomware · Data Extortion · Supply-Chain Compromise
Ransomware Volume
445
Healthcare provider attacks (2025)
+ 191 on vendors. 201 attacks in Q1 2026 alone (120 providers + 81 vendors). 96% involve data exfiltration alongside encryption.
Supply-Chain Blast Radius
192.7M
Records — single vendor incident
Change Healthcare (ALPHV/BlackCat). One vendor compromise cascades to N hospitals, payers, pharmacies. Henry Schein hit twice; Cencora exfiltration; Synnovis took NHS pathology down.
Notification Gap (median)
90+ d
Beyond HIPAA 60-day window
NTBHA: ~5-month delay. IPPC: ~6-month review. Southern IL Dermatology: 4 months discovery → notification. Pattern: detection-to-notice consistently slips the regulatory window.
State-Actor Wedge
Iran
Handala (MOIS) — Stryker wiper
DOJ attribution holds. Pattern: nation-state actors using ransomware aesthetics for cover. Watch list: Russia (Black Basta, BlackCat), DPRK (Lazarus), Iran (MOIS proxies).