In short: In the first half of 2026 the number of cyberattacks on Russia's healthcare sector grew 2.7 times compared with the same period of 2025, according to the Red Security SOC monitoring centre. The share of healthcare in all repelled incidents rose from 6% to 15%, and 38% of them were rated highly critical by the organisations themselves. The attackers' goal is patient personal data — and the more of it leaks, the more it fuels targeted phishing against ordinary people.
What happened
On 15 July 2026, the Red Security SOC cyberattack monitoring and response centre reported that in January–June 2026 the number of attacks on medical organisations in Russia rose 2.7 times year on year. Healthcare's slice of all detected incidents jumped from 6% to 15%, making it one of the fastest-growing targets. The attacks are not only more frequent but more dangerous: 38% of the incidents were assessed as highly critical by the affected organisations. If you want to know whether your own records have already surfaced somewhere, start with our guide on how to check for a personal-data leak.
Why healthcare has become a target
Most attacks begin with the exploitation of vulnerabilities on the IT perimeter — external services and systems reachable from the internet. From there, attackers move toward their real goal: stealing patients' personal data, encrypting information with ransomware, or destroying the infrastructure of a clinic or hospital. Analysts point to a mix of motives — direct financial gain and loud media effect — that makes the sector increasingly attractive.
The problem is compounded by uneven defences. Only the largest medical organisations show a high level of information-security maturity; most institutions rely on basic tools alone. The scale of the resulting exposure is stark: in 2026, roughly one million medical records appeared in open access in March, about 1.2 million in April, and tens of thousands more in May. Earlier data cited by monitoring services suggested medical organisations were being attacked on average every ten hours.
Why this is dangerous for your data
A medical record is one of the most sensitive datasets that exists about a person: full name, contacts, documents, diagnoses and treatment history. When such a base leaks, criminals do not just sell it — they use it to craft highly convincing phishing. A message that quotes your real clinic, appointment or diagnosis lowers your guard far more effectively than a generic scam. Combined with credentials from other breaches, like the billion-record infostealer leak we reported earlier, leaked medical data turns into a ready-made toolkit for account takeover and fraud.
Importantly, patients rarely have any control over a hospital's servers. What you can control is your own side of the connection — the accounts, devices and networks you use to reach medical portals, book appointments or receive results.
How to protect your data
Use strong, unique passwords and two-factor authentication. A separate password for every medical or government portal, stored in a password manager, means one leak cannot unlock your other accounts. Turn on 2FA wherever health data is involved.
Treat unexpected "clinic" messages as suspicious. If an email or SMS about your health asks you to log in, pay or confirm data via a link, open the service yourself in the app or browser instead. Our guide on protecting accounts from hijacking lists the warning signs.
Encrypt your connection on untrusted networks. A VPN cannot secure a hospital's servers, but it protects your side: on public or shared Wi-Fi — a clinic waiting room, a café — it routes your traffic through an encrypted tunnel, so others on the same network cannot intercept the logins and sessions you use for medical or banking portals. LiMP VPN is a no-logs service for iOS and Android — see the features and plans, and more privacy news on our blog.
Sources
This report is based on data from Red Security SOC as published by CNews and SecPost, July 2026.