Cyberattacks: why medical practices are targeted, and how to protect yourself

We often imagine cyberattacks reserved for large companies. The reality in 2026 is the opposite: small healthcare structures are prime targets. They hold highly sensitive data, and they are often less protected than a large organisation. The good news is that a practice's cybersecurity is not a matter of big budgets: it is a matter of hygiene. This guide explains why you are concerned, what the most common attacks are, and the simple measures that cover the bulk of the risk.

1. Why healthcare is a favoured target

Three reasons combine:

• Health data is valuable. A medical record contains a complete and lasting identity, impossible to "reset" like a bank card that can be blocked: that is what makes it valuable to an attacker.
• A practice cannot stop. When the schedule and the records are locked, the pressure to pay a ransom and resume work is enormous. Attackers know it.
• Few structures have a dedicated IT team. The trio "valuable data, high pressure, limited defence" is exactly what an opportunistic attacker looks for.

Importantly, most attacks are not targeted. They are automated campaigns that cast a wide net and hit whoever is not protected. You do not need to be "interesting" to be hit, just vulnerable.

2. The most common attacks, without the jargon

• Phishing. An email that imitates a supplier, a bank, an insurer or an authority to steal your credentials or have you open a booby-trapped attachment. It is the number-one entry point, and it targets the human, not the machine.
• Ransomware. Software that encrypts your files and demands a ransom to unlock them. Without a backup, it is a disaster: schedule, records, everything becomes inaccessible.
• Weak or reused passwords. A single password guessed or recovered from a leak, and it is access to everything else if you use it everywhere.
• Theft or loss of hardware. An unencrypted laptop or USB stick is the patient file out in the open.

3. The measures that really matter

• Two-step login security (a code on top of the password) on anything touching patient data. It is the measure with the best effort-to-protection ratio: even a stolen password is no longer enough to get in.
• Automatic, restorable backups. A backup you have never tried to restore is not really a backup. It is your safety net against ransomware.
• Updates. Software, website, browsers, system. Most attacks exploit flaws already fixed that no one has installed.
• Unique passwords, ideally with a password manager (which creates, remembers and fills them for you).
• Device encryption. Available on recent Macs and PCs, but you still need to check it is actually switched on. A stolen, encrypted device stays unreadable.
• Serious, compliant hosting (see the revFADP): knowing where the data is and who accesses it.
• Email caution. At the slightest doubt, do not click, verify through another channel (a phone call, for example).

4. Where to start: measures by effort-to-protection ratio

Measure	What it protects	Effort
Two-step login security	Against stolen passwords	Low
Automatic, restorable backups	Against ransomware and data loss	Low to medium
Regular updates	Against known flaws	Low
Unique passwords + manager	Against the domino effect of a leak	Low
Device encryption	Against hardware theft	Very low (often just to enable)
Email vigilance	Against phishing	Low (a habit)

All these measures are within your reach, without a significant budget. Start with the first two: on their own they cover the bulk of the risk.

5. And what about the website?

A well-built, maintained site (security updates, up-to-date hosting) is not a weak point. A site abandoned for three years is: it becomes an entry point for automated attacks. And if your site includes a management area or appointment booking, two-step security and backups are not optional: they are the foundations.

6. What to do if you are a victim?

Keeping a cool head changes everything. The right reflexes:

• Disconnect the affected device or system from the network to limit the spread.
• Do not pay in a panic in case of ransomware: paying guarantees nothing and encourages attackers. Your backups are your best option.
• Ask for help from a trusted IT professional.
• Assess whether patient data is involved: if so, the obligations of the revFADP apply (possible notification to the FDPIC and the people concerned).
• Document what happened and the measures taken.

Frequently asked questions

My practice is small, am I really a target?

Yes. Most attacks are not aimed at anyone in particular: they cast a wide net and hit whoever is not protected. Being small does not protect you; being up to date does.

Is two-step security complicated to set up?

No. In practice, it is a code received via an app or a second factor at login. A few minutes of setup, for a considerable gain in protection. It is the measure to enable first.

Should you pay the ransom in case of ransomware?

It is strongly discouraged: paying does not guarantee you will recover your data and it funds the attackers. It is precisely so you never have to ask the question that you need restorable backups.

Is an antivirus enough?

No. An antivirus is useful, but it replaces neither two-step security, nor backups, nor updates, nor email vigilance. Security is a set of reflexes, not a single piece of software.

What about old computers and USB sticks?

Before getting rid of them, actually wipe the data (a simple "empty the bin" is not enough). And while you are using them, check that they are encrypted.

The bottom line

A practice's cybersecurity is not a matter of big budgets, it is a matter of hygiene. A few habits, applied seriously, already put you out of reach of the vast majority of attacks. The right question is not "could it happen to me", but "would I be ready if it did". If the answer is no, start with two measures: two-step login security and backups. On their own, they cover the bulk of the risk.

Sources

• Federal Office for Cybersecurity (FOCS, formerly NCSC) · half-yearly reports: a large share of reported ransomware incidents concern SMEs; recommendations (multi-factor authentication, staff awareness).
• SWI swissinfo.ch · Better protecting the health sector from cybercriminals.