Desk live·
ForensicPost
Ransomware/Healthcare/File 25-1222b

The Healthcare Year, as This Database Recorded It

Forty-odd files on one sector across 2025. Set end to end they describe a system where the data is duplicated six times, the estate cannot be patched, and the harm nobody counts is the one that matters.

Constructed geometry · not a chart of case data
TargetHealthcare sector
ActorMultiple
D. Kennedy & S. Rosler13 min readConfidence: medium3 sources reviewed

This file collects what the corpus recorded about healthcare in 2025.

The Exposures

13,924,906 at an insurer, at 25-0618. 5,556,702 at one health system, at 25-0308. 5.4 million at a subsidiary, at 25-0605. 4.7 million at a health plan, at 25-0409. 2,947,264 and 2,689,826 at two providers, at 25-0210 and 25-0412. 934,000 at a regional hospital, at 25-0127. More than 25 million at a vendor with no patients, at 25-0801.

And 343 filings in six months, at 25-0630, because it is the only sector compelled to count.

The Disruptions

Ambulances diverted, at 25-0127b. Six hundred applications withdrawn and a return to paper, at 25-0520. Nineteen days inside a dialysis provider, at 25-0412. One hospital in three reporting care impact, at 25-0715.

None of it appears on any register, which is the availability gap at 26-0209 in the sector where it is least abstract.

The Structure

Six copies of every episode of care, at 25-1010. Suppliers producing the largest exposures every year, at 25-0801. An estate that cannot be patched without revalidation, at 25-1220b. Funding that competes with clinical spending.

And the one recommendation this corpus makes constantly — retention discipline — running hardest into legitimate counter-pressure here, at 25-0308, because medical records have clinical value for decades.

The Remedies

Credit monitoring, offered by credit bureaux, at 25-0828. It addresses new credit opened in your name and nothing about a leaked diagnosis, at 25-1010. A settlement of $3.81 per person for laboratory data, at 25-0410.

The compensation ledger at 25-1227 found the rule: quantifiable loss is paid, unquantifiable loss is not. Almost nothing in healthcare is quantifiable.

What The Corpus Would Change

One thing, and it is cheap. Emergency services already record diversion status and transport time. Connecting that data to incident dates would convert the sector’s central harm from an anecdote into a measurement, and would let the funding case at 25-0715 be made on clinical risk rather than regulatory penalty.

Everything else in this synthesis is hard, expensive and contested. That one is neither, and nobody is doing it.

This is an analysis file

It synthesises the healthcare files recorded in this database for 2025. Sources below support the sector figures; individual incidents are sourced in their own files. Corrections: corrections@forensicpost.com.

Sources
  1. Largest healthcare data breaches of 2025HIPAA Journal
  2. One in three hospitals confirm cyber incidents directly impacted patient careCensinet
  3. Ransomware in healthcare: the attack timelineCybelAngel
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary