SonicWall Research Sounds Code Red on Healthcare Cybersecurity as Attack Rates Refuse to Decline

New Healthcare Protect Brief reveals 13.3 million remote desktop exploitation attempts and more active ransomware families than any other tracked vertical

MILPITAS, Calif., June 23, 2026 /PRNewswire/ -- SonicWall today released its 2026 Healthcare Protect Brief, a vertical-specific companion to the SonicWall 2026 Cyber Protect Report, revealing that healthcare cybersecurity remains the most persistently targeted industry in SonicWall's global telemetry, and that the gap between healthcare and every other sector is widening, not closing.

While attack volumes across most verticals declined between 17% and 56% year-over-year, healthcare recorded the smallest decline of any tracked industry. The finding is not simply that healthcare is heavily targeted - it's because attackers are less willing to leave healthcare than anywhere else.

"Healthcare is the most targeted industry for several reasons, and none of them are accidental," said Michael Crean, SonicWall SVP of Managed Services. "What our research makes clear is that attackers have done the math. Hospitals cannot go dark, downtime is measured in patient outcomes and the pressure to pay is unlike anything in any other sector. None of that changes until healthcare stops relying on security architectures built for a world that no longer exists, and starts treating Zero Trust not as a future initiative, but as the baseline they needed yesterday."

SonicWall's Healthcare Protect Brief draws on data from SonicWall's global network of more than one million security sensors to document the specific attack patterns, exploitation vectors and ransomware campaigns defining the healthcare threat landscape in 2026.

Key Findings from the 2026 SonicWall Healthcare Protect Brief

• Healthcare recorded the smallest attack decline of any tracked vertical, just 17% year-over-year
• UltraVNC buffer overflow attacks generated 13.3 million hits in five months, a finding unique to healthcare
• IoT exploitation spanned 243 unique attack signatures targeting connected medical devices
• Ten active ransomware families operated simultaneously against healthcare — more than any other vertical
• Log4j generated 11.4 million hits despite being patched in 2021
• Malware hits per firewall reached 102,209 in H1 2026 — four times the next-highest vertical

Three Problems. One Industry. No Easy Exits.
Healthcare's attack surface has three structural problems that attackers have learned to exploit with precision. Remote desktop tools (necessary for distributed clinics, telemedicine and third-party vendor access) generated 13.3 million UltraVNC exploitation attempts in the first five months of 2026 alone. When those tools are internet-exposed without layered controls and backed by VPN architectures that grant broad network access the moment credentials are validated, a single stolen login compromises the entire environment.

The Internet of Things (IoT) footprint makes it worse. Exploitation spanned 243 unique attack signatures targeting connected medical devices that cannot be patched, cannot run endpoint agents and share network segments with clinical systems. A Hikvision vulnerability from 2021 is still generating millions of detection events in 2026. Legacy vulnerabilities do not expire. Against that backdrop, ten ransomware families operated simultaneously against healthcare in the first half of 2026. That is not opportunism. It is a calculated market decision driven by one simple reality: healthcare cannot absorb downtime, and the pressure to pay is unlike anything in any other sector.

"Healthcare does not have a cybersecurity problem," continued Crean. "It has three of them, and attackers have figured out how to use all of them at the same time."

The Architecture Problem Has a Known Solution
The vulnerabilities documented in the Healthcare Protect Brief are well understood, and the controls that address them exist. What slows deployment is not the technology; it is the absence of a repeatable process for standing it up across facilities that open on compressed timelines. SonicWall Cloud Secure Edge (CSE) solves the architectural problem by applying Zero Trust principles to every access request, granting application-level access only and continuously re-verifying identity and device posture. A compromised credential no longer means a compromised network.

SonicWall partner Fornida proved that deployment at scale is achievable. Working with ExaltHealth across five operating rehabilitation hospitals and eight more in planning, Fornida embedded Zero Trust into a standardized opening playbook. It ships pre-configured with every facility's equipment package. Legacy VPN is retired facility by facility. No network rebuild required.

"What the ExaltHealth engagement taught us is that security cannot be an afterthought in a hospital opening," said Farzad Vahid, Founder and CEO, Fornida, a trusted SonicWall partner. "By the third facility, Zero Trust was built into our standard playbook. Five hospitals operating. Eight more planned. That only works if security is a system, not a fire drill."

Availability
The SonicWall 2026 Healthcare Protect Brief is available at https://www.sonicwall.com/threat-report. It is the first in SonicWall's 2026 Vertical Series, accompanying the SonicWall 2026 Cyber Protect Report released in March 2026.

About SonicWall
For more than 30 years, SonicWall has championed a partner-first model that combines purpose-built technology, cloud-delivered security services and real-time threat intelligence to help businesses prevent breaches, reduce risk and stay operational in the face of evolving modern threats. We are committed to deliver the best security outcomes for our customers where others deliver features and functions.  Through its unified cybersecurity portfolio and global community of over 17,000 partners, SonicWall enables managed service providers to actively manage, continuously optimize and measurably protect networks, cloud environments, endpoints and applications. The company is redefining cybersecurity around outcomes that matter to business leaders, including breach prevention, compliance achievement, cost efficiency and reduced human error, because protection is not about what a product can do but about what it actually delivers.

SOURCE SonicWall