Four Properties Combine in Healthcare That Combine Nowhere Else

Given the 22% concentration at 25-1211b, this file sets out what the corpus can say about why.

A retailer that stops trading loses revenue. A manufacturer that stops building loses five weeks, at 25-0902. A hospital that stops treating diverts ambulances, at 25-0127b, and withdraws six hundred applications, at 25-0520.

That is the strongest pressure to restore quickly of any sector here, and an extortion operation is selecting for exactly it.

The corpus filed at 26-0426 that the sector combines sensitive data with thin capacity, and at 25-0715 that funding cases have historically had to be made on regulatory penalty because care impact was unmeasured.

Security competes with clinical spending, in institutions where that comparison is uncomfortable to make out loud.

Medical devices are certified as configured, run for a decade or more, and cannot be patched without revalidation — the constraint filed at 25-0729 for utilities and at 25-0415 for device manufacturing.

A hospital carries the operational-technology problem of a utility alongside the data-protection problem of a bank.

The largest healthcare exposures of 2025 were not at providers: Episource at 25-0605, the back-office administrator at 25-0801, Aflac at 25-0618, Laboratory Services Cooperative at 25-0410.

A single episode of care generates records at a provider, an insurer, a laboratory, a pharmacy benefit manager, a billing processor and a risk-adjustment vendor — six copies, six independent exposures, per 25-1010.

That attackers reason through these four properties deliberately. The affiliate-market explanation at 25-1215b — access flows to the largest platforms, and healthcare produces a lot of accessible targets — may account for the concentration without any sector intent at all.

Both readings predict the same statistic. Graded medium: this is a synthesis across the database, and the corpus cannot distinguish deliberate targeting from opportunistic accumulation.