SonicWall warns healthcare cyberattacks stay high despite overall decline in 2026

SonicWall’s 2026 Healthcare Protect Brief, based on telemetry from more than one million sensors, found that the healthcare sector remains the most persistently targeted industry for cyber‑attacks. While attack volumes fell between 23 % and 56 % year‑over‑year in most verticals, healthcare recorded the smallest decline – only 17 % – widening the gap with other sectors.

The report identified three structural problems that attackers exploit: internet‑exposed remote‑desktop tools used for tele‑medicine and vendor access (13.3 million UltraVNC attempts in five months), a large Internet‑of‑Things footprint with 243 unique attack signatures on medical devices, and legacy VPN architectures. Ten active ransomware families operated simultaneously against healthcare, and malware hits per firewall reached 102,209 – four times higher than the next‑highest industry. Legacy vulnerabilities such as Log4j (11.4 million hits) continue to generate detections despite patches.

Michael Crean, SonicWall’s senior vice president of managed services, said, “Hospitals cannot go dark; downtime is measured in patient outcomes and the pressure to pay is unlike anything in any other sector.” The brief recommends adopting Zero Trust principles, with SonicWall Cloud Secure Edge providing application‑level, continuously verified access to mitigate these threats.