SecurityScorecard Report Reveals How Healthcare Cyberattacks Could Disrupt Hospitals and Endanger Rural Patient Care Across the U.S.
Cybersecurity threats are becoming an increasingly serious challenge for healthcare organizations across the United States. Hospitals, clinics, and healthcare networks depend on interconnected digital systems to manage patient records, diagnostic imaging, communications, medical equipment, and essential facility operations. While these technologies support modern healthcare delivery, they also create opportunities for cybercriminals to disrupt services, access sensitive information, and affect patient care.
A cyberattack targeting a hospital can have consequences that extend far beyond its information technology department. When critical systems become unavailable, healthcare professionals may struggle to access patient records, diagnostic information, and communication platforms. Surgical procedures can be postponed, emergency services may experience delays, and hospitals may be forced to return to manual, paper-based processes.
These disruptions can be particularly serious for rural communities, where healthcare facilities are often separated by considerable distances. Patients in urban areas may have access to alternative hospitals nearby, but residents of rural counties may need to travel 30 miles or more to reach another facility. If their local hospital experiences a major technology disruption, access to essential medical services could be delayed or interrupted.
Addressing these growing concerns, SecurityScorecard has released a new report titled Visiting Hours: What Hackers See When They ‘Drop By’ America’s Hospitals and Clinics. The report provides an outside-in assessment of cybersecurity risks affecting healthcare facilities across the United States and examines how vulnerabilities at individual hospitals can create wider risks for surrounding communities.
The research draws on Project Meridian, SecurityScorecard’s geospatial intelligence platform, which maps cyber and physical risks across the nation’s 16 critical infrastructure sectors. The platform connects information about healthcare facilities with the energy, telecommunications, water, technology, and supplier networks on which they depend.
Through this approach, the company aims to help healthcare leaders understand what potential attackers can identify from publicly accessible internet-facing systems, determine where cybersecurity weaknesses are concentrated, and prioritize improvements before an incident disrupts patient services.
The report also provides healthcare organizations, hospital administrators, state health departments, and policymakers with a practical 30-day action plan for addressing critical cybersecurity exposures.
Healthcare Organizations Face Increasing Cybersecurity Exposure
Healthcare organizations have become attractive targets for cybercriminals because of their dependence on digital infrastructure and the importance of maintaining uninterrupted clinical operations.
Attackers routinely examine internet-facing systems for outdated software, weak authentication practices, exposed services, and compromised credentials. Once they identify an accessible vulnerability, they may attempt to exploit it directly or use a third-party supplier as an entry point into a healthcare organization.
These attacks do not necessarily begin with the hospital itself. Healthcare providers often depend on external technology companies, software vendors, service providers, and infrastructure operators. A security weakness within one supplier can potentially create exposure across multiple healthcare organizations that use the same service.
According to SecurityScorecard, cyberattacks have affected hospitals and health systems in several U.S. states over the past 18 months, including Texas, Missouri, South Carolina, Massachusetts, Mississippi, and Ohio.
The consequences can extend into multiple areas of hospital operations. Electronic patient records may become inaccessible, imaging systems can experience disruptions, telephone services may stop functioning, and building management systems may be affected.
When these systems are unavailable, healthcare professionals may need to change established workflows to continue providing care. Staff may have to rely on paper documentation, reschedule procedures, or redirect patients to other facilities.
The impact is especially concerning when emergency departments and critical care services are affected. Even temporary technology interruptions can create operational challenges for hospitals that depend on real-time access to clinical information.
SecurityScorecard’s report emphasizes that cybersecurity should therefore be considered an essential component of healthcare operational resilience rather than a separate technical responsibility.
Project Meridian Connects Cyber and Physical Infrastructure Risks
A central feature of the report is SecurityScorecard’s Project Meridian platform, which provides a connected view of cybersecurity and physical infrastructure risks across the United States.
The platform addresses a limitation in traditional cybersecurity assessments. Organizations frequently evaluate their own technology environments without having a complete understanding of the external infrastructure and third-party services that support their operations.Project Meridian seeks to provide a broader perspective by mapping healthcare facilities alongside the critical infrastructure and suppliers connected to them.
The platform examines information that is publicly visible to anyone accessing the internet, including potential attackers. It uses this outside-in intelligence to identify exposed systems, cybersecurity weaknesses, shared vendor relationships, and geographic dependencies.For healthcare organizations, this means leaders can examine a hospital’s cybersecurity posture while also understanding the infrastructure supporting its operations.
For example, a hospital may depend on external electricity providers, telecommunications networks, water systems, cloud services, and technology vendors. A disruption affecting one of these dependencies could create operational consequences for the hospital, even if its internal systems are not directly attacked.
By bringing these relationships together on a single map, Project Meridian is designed to help decision-makers understand how one cybersecurity incident could potentially affect other facilities and essential services in the surrounding region.The report also highlights the growing importance of this type of visibility as artificial intelligence changes the cybersecurity threat landscape.
AI technologies are reducing the time required to identify potential vulnerabilities and develop ways to exploit them. This creates additional pressure on healthcare security teams to identify and address weaknesses before attackers can take advantage of them.
SecurityScorecard also points to public reporting about nation-state actors seeking to establish access within critical infrastructure environments. Such activity raises concerns about the potential targeting of technology suppliers and interconnected services that could provide access to multiple organizations.
The company argues that understanding these relationships is essential to protecting healthcare infrastructure and maintaining reliable patient services.
Major Findings Highlight Cybersecurity Weaknesses Across Healthcare
SecurityScorecard’s report analyzes thousands of healthcare facility records and identifies several areas requiring attention.
The findings show that although many healthcare facilities receive relatively strong cybersecurity grades, significant vulnerabilities remain across the sector.
The report highlights six important findings.
1. Known exploited vulnerabilities remain widespread
Approximately one in seven healthcare records reviewed carries a Known Exploited Vulnerability (KEV) designation.The research identified 5,862 records with a KEV flag. These designations refer to software vulnerabilities that the Cybersecurity and Infrastructure Security Agency (CISA) has identified as being exploited in real-world cyberattacks.This finding is particularly important because these vulnerabilities are not simply theoretical security weaknesses. Their inclusion in the CISA catalog indicates that attackers have already used the identified flaws.Healthcare organizations operating affected systems may therefore face increased exposure if vulnerabilities remain unaddressed.
2. Most graded healthcare facilities receive strong cybersecurity scores
The report evaluated 7,818 graded healthcare records.Of these, approximately 62.5% received an A or B grade, indicating comparatively strong cybersecurity ratings based on the assessment.However, the findings also identified significant weaknesses. Approximately one in six graded facilities received a D or F.
This suggests that cybersecurity performance varies across the healthcare sector, with some facilities maintaining stronger external security postures while others continue to face substantial exposure.The findings also demonstrate why healthcare organizations need to examine individual vulnerabilities rather than relying exclusively on overall security ratings.
3. A high cybersecurity grade does not eliminate critical vulnerabilities
One of the report’s notable observations involved a Texas health system that received an A grade but still had eight urgent vulnerabilities present on live systems.According to SecurityScorecard, this was the highest number of such vulnerabilities identified among the groups examined.
The example demonstrates that an overall cybersecurity rating does not necessarily indicate that every system is secure.A healthcare organization may perform well across several security measurements while still operating machines with vulnerabilities that attackers could exploit.
For hospital administrators and security teams, the finding reinforces the importance of investigating individual weaknesses and prioritizing critical exposures even when an organization’s overall rating appears favorable.
4. Shared suppliers create interconnected cybersecurity risks
The report’s Texas case study examined supplier relationships across 12 hospital groups.It found that 72 of 313 suppliers appeared in the networks of at least two hospital groups. Additionally, 11 of the 12 groups used Microsoft services.These findings illustrate the interconnected nature of healthcare technology infrastructure.
When multiple hospitals rely on the same supplier, a security incident involving that supplier may potentially affect several healthcare organizations.The report refers to the 2024 Change Healthcare cyberattack as an example of the operational consequences associated with concentrated third-party risk.
That incident disrupted healthcare billing and pharmacy-related services across the United States, demonstrating how a problem involving a shared service provider can extend across a large portion of the healthcare system.
5. Rural clinics face additional challenges
Rural healthcare facilities may have fewer alternatives when technology disruptions affect their operations.The report found that rural clinics received D or F cybersecurity grades more frequently than hospitals, at 16.7% compared with 15.2%.Although the difference is relatively small, the geographic circumstances of rural healthcare delivery make these weaknesses particularly important.
When a rural clinic becomes unavailable, patients may have to travel considerable distances to access another facility. In some communities, the nearest alternative hospital may be approximately 30 miles away.This can create additional difficulties for patients who need emergency assistance, ongoing treatment, or timely access to medical services.
6. Exposed credentials represent another area of concern
The research identified leaked-credential signals across 3,767 healthcare records, representing approximately 9.6% of the records examined.Additionally, 10 records showed indicators consistent with possible compromise.Leaked usernames and passwords can provide attackers with opportunities to access organizational systems, particularly when credentials are reused or additional authentication protections are absent.
For healthcare providers, compromised credentials may create risks involving employee accounts, remote access services, email platforms, and patient-facing systems.The findings reinforce the importance of strong authentication policies, regular credential monitoring, and prompt password resets when exposure is identified.
Texas Case Study Identifies Critical Vulnerabilities
Beyond its national assessment, the report includes a closer examination of cybersecurity exposures within Texas healthcare organizations.The case study demonstrates how a broad list of potential weaknesses can be narrowed down to a smaller number of confirmed vulnerabilities that require immediate attention.
SecurityScorecard initially identified 316 possible vulnerabilities in the Texas sample. Following additional examination, the company narrowed the list to nine vulnerabilities confirmed on live systems and included in the CISA Known Exploited Vulnerabilities catalog.
Five of these nine vulnerabilities were identified on the hospitals’ own machines.The report further states that three of those five vulnerabilities have been used in ransomware attacks, according to CISA.This distinction is important for healthcare security teams because not every identified vulnerability presents the same level of immediate risk.
Organizations need to determine which weaknesses are present on active systems, whether attackers are known to exploit them, and how the affected technology supports clinical or administrative operations.By narrowing the findings to confirmed vulnerabilities, healthcare organizations can develop more focused remediation plans and direct resources toward the systems requiring urgent attention.
The Texas case study also demonstrates why security teams should not rely solely on automated ratings or broad vulnerability counts. A more detailed examination can help identify the specific weaknesses that could create the greatest operational consequences.
Two Major Risks That Could Directly Affect Patient Care
SecurityScorecard identifies two interconnected risk areas that deserve particular attention from healthcare leaders: geographic limitations affecting rural facilities and cybersecurity weaknesses within shared supplier networks.
When the Nearest Hospital Is Miles Away
For rural communities, the availability of a local healthcare facility can be essential to accessing timely medical services.Unlike major metropolitan areas, rural regions may not have multiple hospitals or emergency departments within a short distance.If a cyberattack disrupts a rural clinic or hospital, patients may have limited alternatives. They could face longer travel times, delayed appointments, or interruptions to ongoing treatment.
The report’s findings show that rural clinics receive D or F cybersecurity grades more frequently than hospitals.While these grades measure external cybersecurity posture, the consequences of a disruption can be more significant in locations where healthcare infrastructure is limited.SecurityScorecard argues that protecting rural healthcare facilities should therefore be an important part of national cybersecurity planning.
When a Shared Supplier Creates Wider Exposure
Third-party technology providers play an important role in modern healthcare operations.Hospitals use external vendors for software, cloud infrastructure, communications, billing, cybersecurity, and other essential services.However, these relationships can create concentration risks when several healthcare organizations depend on the same supplier.
The Texas analysis found that 72 suppliers appeared across at least two hospital groups, while 11 of the 12 groups relied on Microsoft.If a widely used supplier experiences a cyber incident or service disruption, multiple healthcare organizations could potentially face operational difficulties at the same time.
The Change Healthcare attack in 2024 demonstrated how disruption involving a major shared healthcare technology provider can affect pharmacies, hospitals, billing operations, and other parts of the healthcare delivery system.SecurityScorecard’s findings suggest that hospitals need to understand not only their internal security weaknesses but also the potential risks associated with their external technology relationships.
Supplier risk management, contingency planning, and visibility into critical dependencies are important components of healthcare cybersecurity preparedness.
SecurityScorecard Leaders Emphasize the Need for Proactive Cybersecurity
SecurityScorecard leadership believes healthcare organizations need a more comprehensive understanding of the risks visible across their digital infrastructure.Dr. Aleksandr Yampolskiy, CEO and Co-Founder of SecurityScorecard, explained that hospitals have physical security measures protecting their buildings, but their internet-connected systems remain accessible to potential attackers around the clock.
He emphasized that many healthcare leaders do not have a complete picture of what attackers can identify when examining their organizations from the outside.According to Yampolskiy, Project Meridian provides a connected view of individual facilities, cybersecurity exposures, shared vendors, and the surrounding infrastructure on which hospitals depend.
He described the platform as a resource that can help healthcare administrators, hospital owners, rural clinics, and security teams identify urgent problems and prioritize improvements.Yampolskiy also stressed that protecting healthcare infrastructure requires leaders to address cybersecurity weaknesses before they become incidents that interrupt patient services.
Michael Centrella, Head of Public Policy at SecurityScorecard and former Assistant Director of the U.S. Secret Service, highlighted the limitations of relying exclusively on overall cybersecurity grades.He pointed to the Texas health system that received an A rating despite having eight urgent vulnerabilities on active systems.
Centrella explained that healthcare facilities are critical infrastructure and that cyberattacks targeting hospitals can develop into public safety concerns.He also called on policymakers to support cybersecurity improvements for rural clinics and smaller hospitals, establish stronger security expectations for critical technology suppliers, and make multi-factor authentication a baseline requirement for remote access, email, and patient portals.
Drawing on his 25 years of experience in federal law enforcement and national security, Centrella emphasized the importance of identifying and reducing security risks before an incident occurs.Richard Hummel, Vice President of Threat Intelligence and Research at SecurityScorecard, discussed the role of publicly accessible internet data in identifying potential cybersecurity weaknesses.
He explained that attackers and defenders often examine the same internet-facing information. The difference lies in how that information is used.Project Meridian applies this intelligence to defensive cybersecurity efforts by mapping exposed systems, supplier relationships, and infrastructure dependencies.
Hummel noted that threat intelligence is most valuable when it helps organizations take preventive action rather than simply understand an attack after it has occurred.Dr. Mike Mylrea, CISO and Chief AI Officer at SecurityScorecard, also highlighted the growing challenges associated with artificial intelligence and healthcare technology.
He explained that AI is shortening the time between vulnerability disclosure and exploitation, making it more difficult for security teams to delay remediation.Healthcare environments present additional challenges because hospitals operate a combination of older servers, connected medical devices, infusion pumps, imaging systems, and building controls.
Some of these technologies are designed to remain operational for many years and may not have been developed with modern cybersecurity requirements in mind.Replacing or updating such systems can also be difficult because doing so may interrupt clinical operations.
Mylrea emphasized that vulnerabilities within one exposed device or supplier can potentially affect multiple hospitals across a region.He said Project Meridian helps identify supply chain vulnerabilities and gives defenders an opportunity to address weaknesses before attackers exploit them.
A 30-Day Cybersecurity Action Plan for Healthcare Organizations
To help healthcare organizations translate the research into practical improvements, SecurityScorecard has included a 30-day action plan for state health departments, hospital groups, and rural clinic networks.The plan focuses on identifying critical exposures, correcting vulnerabilities, strengthening authentication, and preparing for potential operational disruptions.
The recommended approach is divided into four weeks.
Week One: Identify and Prioritize Critical Vulnerabilities
Healthcare organizations should begin by reviewing their cybersecurity records and identifying systems with Known Exploited Vulnerability flags or a high likelihood of exploitation.Security teams should organize these findings according to the type of healthcare facility and the potential operational impact.Each identified issue should have a designated owner responsible for tracking remediation.This process helps organizations establish accountability and ensures that the most urgent security weaknesses receive attention first.
Week Two: Address Confirmed Security Weaknesses
During the second week, healthcare organizations should verify identified vulnerabilities and determine which systems are affected.Where possible, organizations should apply security patches or disable vulnerable services.They should also reset exposed passwords and review accounts associated with leaked credentials.Multi-factor authentication should be enabled to provide an additional layer of protection for accounts and systems.These actions are intended to reduce opportunities for attackers to gain unauthorized access through known weaknesses or compromised credentials.
Week Three: Strengthen Supplier and Infrastructure Security
Healthcare organizations should review their relationships with third-party technology suppliers and identify services that are essential to daily operations.This includes examining shared vendors, understanding critical technology dependencies, and establishing communication procedures for responding to supplier-related incidents.Organizations should also identify the infrastructure services required to maintain hospital operations, including electricity, telecommunications, water, and other essential services.Having this information available can help administrators understand which external disruptions could affect clinical operations.
Week Four: Conduct Downtime Exercises and Prepare Recovery Plans
The final week should focus on operational readiness.Healthcare organizations should conduct a downtime exercise to understand how clinical teams would continue operating if essential technology systems became unavailable.Hospitals and clinics should document where patients could receive care if a facility temporarily closed.They should also maintain an updated list of shared suppliers, emergency contacts, and alternative service arrangements.For rural healthcare networks, this planning is particularly important because the nearest alternative facility may be located many miles away.
By completing these activities, healthcare organizations can develop a more practical understanding of their cybersecurity exposure and their ability to maintain essential services during an incident.
SecurityScorecard Calls for Stronger Government Support
In addition to recommendations for healthcare organizations, the report outlines several actions that policymakers should consider to improve cybersecurity resilience across the U.S. healthcare sector.SecurityScorecard recommends directing additional funding toward rural clinics and smaller hospitals, which may have fewer resources available for cybersecurity improvements.
The company also encourages policymakers to recognize major healthcare technology suppliers as critical infrastructure partners and establish stronger security expectations for providers whose services support multiple healthcare organizations.Another recommendation is to make multi-factor authentication a minimum security requirement for remote access, email systems, and patient portals.
The report also emphasizes the importance of independent, outside-in cybersecurity assessments.Traditional surveys and self-reported security evaluations can provide useful information, but they may not reveal every vulnerability that an external attacker can identify.
Independent assessments can help policymakers understand where cybersecurity risks are concentrated and determine which organizations or infrastructure networks require additional support.SecurityScorecard further recommends funding downtime planning for rural healthcare facilities to help communities prepare for disruptions that could affect access to medical services.These recommendations reflect the broader need to treat healthcare cybersecurity as a national infrastructure and patient safety issue.
Report Availability and Research Methodology
SecurityScorecard has made the full report, including its methodology, available through its website.The research uses outside-in observations of U.S. healthcare organizations and draws on Project Meridian’s national inventory of 39,319 healthcare records as of October 23, 2026.The analysis examines facility records and the vulnerabilities and exposed services associated with their internet-facing systems.
SecurityScorecard clarifies that each record represents a mapped facility site rather than a unique healthcare system or individual patient. Consequently, the figures should be interpreted as facility records, not counts of organizations or people.The company also notes that the identified indicators require verification and do not independently establish that a facility has experienced a breach, that a particular dependency is active, or that patients have suffered harm.
To protect the privacy of healthcare organizations, the report does not identify individual facilities by name.
The full report is available here:
SecurityScorecard – Visiting Hours: What Hackers See When They ‘Drop By’ America’s Hospitals and Clinics
Strengthening Cybersecurity to Protect Healthcare Access
SecurityScorecard’s Project Meridian report highlights how cybersecurity weaknesses can extend beyond individual hospitals and affect the broader healthcare infrastructure supporting communities.The findings demonstrate that strong overall security grades do not necessarily eliminate critical vulnerabilities, while shared technology suppliers can create interconnected risks across multiple healthcare organizations.
The challenges are particularly important for rural communities, where limited healthcare infrastructure can make service disruptions more difficult for patients and providers.By combining external cybersecurity intelligence with geographic infrastructure mapping, Project Meridian aims to help healthcare leaders understand their exposure and identify areas requiring immediate attention.
The company’s 30-day action plan provides a practical framework for addressing known vulnerabilities, strengthening authentication, reviewing supplier relationships, and preparing for technology-related downtime.As artificial intelligence accelerates the discovery and exploitation of cybersecurity weaknesses, healthcare organizations may need to adopt more proactive approaches to protecting their systems.
Ultimately, cybersecurity is closely connected to healthcare service continuity. Protecting patient information, maintaining access to medical technology, and ensuring that hospitals can continue operating during disruptions are essential responsibilities for healthcare providers.
SecurityScorecard’s report reinforces the importance of collaboration among hospital administrators, technology suppliers, security professionals, and policymakers to reduce cyber risk and protect access to healthcare services across the United States.
Source link: https://www.businesswire.com/
