Healthcare was the target of close to 22% of all cyberattacks recorded in India in 2025, up eight percentage points in two years, according to the Data Security Council of India's threat report. Globally, healthcare organisations logged 410 ransomware attacks in the first half of 2026 — a 14% rise on the previous half-year — with India among the five most-attacked countries. The AIIMS attack of 2022 made the headlines; the June 2025 incidents at two mid-size Delhi hospitals, where OPD and IPD digital workflows stopped and staff went back to paper, are the more useful warning for the rest of the country.
This guide is for hospital owners and administrators who do not have an IT security team and never will. It explains how a hospital of 30 to 200 beds actually gets hit, what the first 48 hours look like, and a 15-point checklist you can complete with your existing staff and vendors.
How a mid-size Indian hospital gets hit
- Remote-access tools left open. AnyDesk or RDP on the billing server, installed by a vendor for support and never removed, with a password the whole reception knows.
- An on-premise server nobody patches. Windows Server on a desk in the accounts room, last updated when it was installed.
- Phishing on a shared inbox. A "TPA settlement advice" attachment opened on the one PC that also runs the HMS.
- Shared logins. One admin password used by six people, so when it leaks there is no way to know from where.
- USB drives carrying lab-machine exports between PCs.
- Backups on the same machine — or on an external drive plugged in permanently, which the ransomware encrypts first.
None of these require a sophisticated attacker. Ransomware groups scan the internet for exposed remote-access ports and old software; a hospital is simply a business that cannot afford to be down and is therefore more likely to pay.
What an attack does to a hospital
Registration and billing stop within minutes. The OPD queue reverts to a paper token. IPD nursing charts, drug charts and the pharmacy indent go back to registers, and the doctors' orders from yesterday are inaccessible. Lab analysers keep running but results cannot be entered or delivered. Pending TPA claims cannot be submitted, so cash flow stops with the software. Then the second wave arrives: under the DPDP Act, unauthorised access to patient data is a breach that must be reported to the Data Protection Board and to every affected patient, and under CERT-In's 2022 directions, cyber incidents must be reported to CERT-In within six hours of being noticed. A hospital that has paid the ransom still has both obligations.
The 15-point ransomware protection checklist
Identity and access
- 1. Named logins for every user. No shared accounts, ever. Each person's actions are attributable, and one leaked password locks out one person.
- 2. Role-based access. Reception cannot open clinical notes; pharmacy cannot see accounts. The blast radius of any single compromised account is small.
- 3. Login and activity logs with time, device and IP, reviewed monthly and kept where an attacker cannot delete them.
- 4. Remove every remote-access tool not in active, documented use. Vendor support access is granted per session and revoked after.
Backups
- 5. Automated daily backups that do not depend on someone remembering.
- 6. Off-site and offline copies. A backup on the same network is not a backup. Encrypted copies should sit in at least two independent locations the hospital's own network cannot write to.
- 7. Encrypted backups, with the key held by someone who is not the vendor.
- 8. A tested restore. Restore a full backup to a clean machine at least twice a year and record how long it took. Until you have done this, you do not have a backup; you have hope.
Infrastructure
- 9. Cloud-hosted HMS over an on-premise server. A professionally hosted platform is patched, monitored and backed up by people whose job it is; a server in the accounts room is not. Our cloud vs on-premise comparison covers the trade-offs.
- 10. Patch what remains. Every remaining Windows PC, lab-interface machine and router gets updates on a schedule.
- 11. Encrypt in transit and at rest. HTTPS everywhere, encrypted databases and storage.
People and process
- 12. Phishing awareness twice a year for anyone with an email account — a 20-minute session with real examples from Indian TPAs and vendors.
- 13. A written incident plan with names: who isolates the network, who calls the vendor, who reports to CERT-In within six hours, who notifies the Data Protection Board and patients, who talks to the press.
- 14. A paper fallback kit for 48 hours — registration slips, IPD charts, indent forms — stored physically, so care continues while systems are restored.
- 15. Vendor contracts with security obligations: breach notification timelines, backup guarantees, data residency, and the right to your data on exit.
Cloud vs on-premise, seen from a ransomware attack
| On-premise server | Cloud-hosted HMS | |
|---|---|---|
| Who patches it | Whoever remembers | The vendor, continuously |
| Where backups live | Usually next to the server | Off-site, automated, encrypted |
| Exposed remote access | Common | None into your building |
| What ransomware on a reception PC reaches | The whole database | One browser session |
| Time to recover | Days to never | Hours, from a tested restore |
| Who is accountable | You | Shared, in writing |
What a hospital owner should ask their software vendor this week
- Where is our data hosted, and who can access the servers?
- How often is it backed up, where do the copies go, and are they encrypted?
- When did you last restore a backup for any customer, and how long did it take?
- Can every one of our users have a named login with a role?
- What is your breach-notification commitment to us, in hours?
- If we leave, how do we get all of our data?
Frequently Asked Questions
Why are hospitals targeted by ransomware?
Because they cannot afford downtime, hold data that is valuable to sell, and — particularly mid-size hospitals in India — often run unpatched on-premise systems with exposed remote access and no tested backups. Attackers assume a hospital will pay to get patients treated again.
What should a hospital do in the first hour of a ransomware attack?
Disconnect affected machines from the network and internet without switching them off, stop using any shared credentials, switch to the paper fallback, call your software vendor, and start the incident log. Report to CERT-In within six hours and, where patient data is involved, to the Data Protection Board and affected patients under the DPDP Act. Do not pay before taking advice.
Is cloud hospital software safer than an on-premise server?
For a hospital without a security team, almost always. A cloud platform is patched, monitored and backed up professionally, and a compromised reception PC exposes a browser session rather than the whole database. The trade-off is dependence on internet connectivity and on the vendor's own security practices, which is why vendor contracts matter.
Does a hospital have to report a ransomware attack?
Yes. CERT-In's directions of April 2022 require reporting of cyber incidents, including ransomware, within six hours. Under the DPDP Act, unauthorised access to personal data must be reported to the Data Protection Board and affected individuals; core DPDP obligations are enforceable from 13 May 2027. See our DPDP timeline for hospitals.
Built so an attack on your PC is not an attack on your hospital
Healthixio is cloud-hosted with 256-bit encryption, named users with role-based access, tamper-evident login and activity logs, and encrypted nightly backups to two independent locations with a rehearsed restore. Our security and admin control module explains the controls, and our guide to preventing hospital data leaks covers the insider side.