Healthcare under attack: why cybersecurity is now critical care - Intelligent CISO

Healthcare under attack: why cybersecurity is now critical care Ben Leitch | 16 March, 2026 Africa’s healthcare sector is facing a silent emergency. Many healthcare operators, facilities and doctors across Africa already grapple with the challenges of under-resourced environments, an uneven distribution of resources and massive demand for services. Kerissa Varma, Microsoft’s Chief Security Advisor for Africa, explains how healthcare administrators must turn their attention to a relatively new and extremely urgent concern. While doctors fight to save lives, cybercriminals are infiltrating hospitals, laboratories and clinics, turning life-saving environments into digital battlegrounds. Kerissa Varma, Microsoft’s Chief Security Advisor for Africa A growing epidemic  Recent attacks have exposed the fragility of Africa’s medical infrastructure. In May 2025 Mediclinic Southern Africa was hit by a cyber extortion cyberattack compromising sensitive HR data. Later in 2025 Lancet Laboratories faced a regulatory penalty for failing to notify patients about data breaches under South Africa’s POPIA law, while a ransomware strike on the National Health Laboratory Service disrupted blood test processing nationwide, delaying critical care for millions.  M-Tiba, a Kenyan digital health platform managed by CarePay and backed by Safaricom, suffered a significant cyberattack and data breach in late 2025, while earlier this year Pharmacie.ma, a Moroccan pharmaceutical platform, was reportedly the target of an alleged data leak incident involving the unauthorised export of a customer database. Recent research indicates that Nigeria’s private healthcare sector is now one of the most targeted on the African continent with attacks increasing at an alarming rate.  Many incidents also go unreported as hospitals and healthcare facilities rarely disclose them publicly. These incidents are not isolated, with ransomware dominating the threat landscape. Africa’s healthcare sector is heavily targeted by cybercriminals with healthcare organisations facing an average of 3,575 weekly cyberattacks in 2025, a 38% surge from the previous year. Encryption of patient data, temporary loss of access to hospital systems and the risk of data appearing on the dark web are among the potential impacts.  Why healthcare is a prime target  The healthcare industry in Africa, particularly in the public sector, is working with legacy systems, fragmented infrastructure and underfunded IT teams, all of which combine to make the sector an easy target for cybercriminals.  Many medical institutions are adopting open-source AI tools for diagnostics and patient management. While cost-effective, these platforms often lack enterprise-grade security, leaving sensitive data exposed. Combined with fragmented storage of paper and electronic patient records, often unencrypted and scattered across multiple systems, the risk of breaches multiplies.  Hospitals and healthcare facilities cannot afford downtime. Every minute offline risks lives, making them more likely to pay ransoms in an attempt to regain control of their systems. Cyber insurers indicate that in 2 of 5 cases of a ransom being paid data and operations still cannot be recovered. Additionally, in instances where some or all of the seized data is recovered after paying a ransom, the attacker goes on to request further payments.  Medical records are also a premium target for cybercriminals. In the US researchers found that patient records, insurance details and research data fetch premium prices on the dark web, up to 10 times higher than financial data, according to cybersecurity analysts. A single stolen medical record can sell for $260–$310 compared to $30–$50 for a credit card because unlike credit cards medical records never expire, and medical information cannot be easily changed. Medical records frequently include personal identifiers, insurance details and sometimes biometric data enabling identity theft and fraud. Criminals also use medical data for fake insurance claims, prescription fraud and targeted scams. Microsoft believes cybersecurity needs to be embedded into every technology implementation, and this should be a key priority especially when handling sensitive medical data and operations.  How healthcare can use modern technology safely  As Africa’s healthcare systems digitise and embrace AI, protecting the digital lifeline must become as critical as protecting the physical one. Key steps can secure healthcare organisations and facilities such as laboratories and diagnostic services.  Include cybersecurity in your resilience planning  Medical professionals and healthcare facilities often prioritise the resilience of physical capabilities. Power backups, multiple devices should equipment fail and standby staff in the event of a practitioner being unavailable are all practices that save lives.  Equally, cybersecurity and safeguarding online systems must be built into the overall resilience planning of medical facilities and services.  Investing in cybersecurity technology that can quickly identify and contain attacker activity before it leads to system downtime or data theft can save lives. Having a response plan that is practised and maintained in the event of a cyber breach and ensuring strong data backups could mean the difference between a total failure of health services or a minor incident. Ensuring incident response plans are aligned with local compliance laws such as South Africa’s POPIA and Kenya and Nigeria’s Data Protection Acts is critical for healthcare providers.  Prepare for AI-driven attacks that are going to increase attacker speed and success  Threat actors are increasingly exploiting the interconnectedness of modern software ecosystems and operational structures to conduct malicious activity, so regular auditing of third-party integrations, especially those involving AI or cloud services, is critical.  Adversaries are using AI to scale and tailor operations with AI-driven phishing being 4.5x more effective than traditional phishing. However, AI is also transforming cyber defence by automating response and containment, detecting threats faster and more accurately and identifying detection gaps while adapting to attacker behaviour. Healthcare organisations should invest in AI-driven threat detection for faster response and anomaly detection and must also secure AI models and data pipelines through robust access controls, vulnerability scanning and regular patching for open-source tools.  Remote and wider access to patient records requires strong identity practices  As both patients and medical professionals begin accessing patient records digitally strong identification, verification and authentication processes are critical. The Microsoft Digital Defense Report 2025 notes that the abuse of valid accounts is a frequent occurrence with attackers gaining access to usernames and passwords and using them to infiltrate systems without triggering traditional security alerts. Organisations must deploy phishing-resistant multifactor authentication and conditional access to strengthen user defences.  Invest in people and skills  People are at the heart of robust cybersecurity measures. Healthcare organisations must train staff against common tactics such as phishing, the most common entry point for attackers and apply role-based access controls for both clinical and research data to prevent privilege misuse.  Cybersecurity is no longer an IT issue it is a patient safety issue. Healthcare providers must treat digital resilience with the same urgency as infection control. By investing in comprehensive cybersecurity strategies and leveraging AI-powered defences Africa’s healthcare sector can strengthen its ability to withstand emerging threats and build more resilient digital ecosystems.