Hospital cyberattacks threaten patient safety
In this article, Fox News’s Kurt Knutsson looks at how cyberattacks on hospitals are disrupting patient care, using the ransomware attack on the University of Mississippi Medical Center as an example. Attackers increasingly go after people inside hospitals. They use AI to clone voices, write convincing emails, and create deepfakes of doctors, vendors, or IT staff. Ricardo Amper, Incode’s founder and CEO, explains why hospitals make such appealing targets. They hold medical records, identity information, and insurance details, and they’re under heavy pressure to get systems back up quickly. He argues that identity is now the front line of cybersecurity. For hospitals and their vendors, that makes stronger identity verification, layered authentication, and deepfake detection essential.
Read the transcription of this article, published by Fox News on March 20, 2026.
If you watched a recent episode of "The Pitt" on Max, a streaming medical drama about life inside a high-pressure emergency department, you saw how quickly a hospital can spiral during a cyberattack. It made for gripping television. But in Mississippi, it was not a script. It was real life.
After a ransomware attack hit the University of Mississippi Medical Center, clinics across the state closed. Elective procedures were canceled. Phone systems and emails went down. Emergency care continued, but access to electronic medical records was disrupted.
When a hospital's systems fail, the impact goes far beyond IT. It affects real people waiting for care. That is why hospital cyberattacks are no longer just a tech problem. They are a public safety issue.
Why hospitals have become prime targets
Hospitals cannot afford downtime. When systems fail, patient care is immediately affected, and the pressure to restore operations is intense. Ricardo Amper, founder and CEO of Incode Technologies, a digital identity verification and biometric authentication company, explains the reality.
"Hospitals are in a uniquely difficult position. If systems go down, patient care is immediately affected. That creates real pressure to restore operations fast, which is why ransomware groups often target healthcare." He points to another major factor driving hospital cyberattacks. "Hospitals hold some of the most sensitive data that exists, including medical records, identity information and insurance details. That combination of urgency and high-value data makes them very attractive targets."
Healthcare systems also rely on vendors and service providers. One weak link can open the door. "In healthcare, you're only as secure as the entire ecosystem around you," Amper said.
How AI-powered impersonation is changing the game
Many people imagine hackers breaking through firewalls. That still happens. But today, attackers often target people instead of systems. "What we're seeing more and more is that attacks aren't always about breaking into systems, they're about tricking people," Amper said.
Artificial intelligence (AI) has made impersonation easier and scalable. Criminals can clone voices, generate convincing emails or create deepfake videos that appear to come from a trusted doctor, vendor or IT administrator. "AI doesn't replace social engineering, it supercharges it."
In practical terms, that might mean an employee receives what looks like a legitimate request to reset a password or approve a login. One click can open the door. "An employee is tricked into giving up credentials or approving a fraudulent authentication request. The attacker logs in as a legitimate user, and from there, they move quietly through internal systems," Amper explained. Because the activity appears to come from a real employee, it may go undetected until significant damage is done.
Why hospitals are especially vulnerable to cyberattacks
Inside a hospital, speed matters. Decisions happen quickly, and staff move from one urgent task to the next. That constant pressure creates opportunities for attackers who rely on deception. "Healthcare professionals are focused on patients, not cybersecurity. They work in high-pressure environments where speed matters. That urgency can make it easier for attackers to exploit trust or distraction," Amper said.
Many hospitals also operate with legacy systems layered over time. Security was often added after the fact rather than built in from the start. That complexity increases risk. He also challenges how leaders think about the problem. "One misconception is thinking of cybersecurity as just an IT problem," Amper said.
Today's hospitals depend on digital systems for intake, diagnostics and billing. When those systems fail, care delivery suffers. "Cybersecurity today is fundamentally about operational resilience. It's about keeping the hospital running safely and continuously."
What happens to your data after a breach
When a hospital is breached, the exposed data often goes beyond a credit card number. "Breaches can expose medical histories, Social Security numbers, insurance information, billing details and contact data," Amper said.
That combination is powerful. Criminals can use it for identity fraud, insurance fraud and highly targeted scams. Unlike a credit card, a medical identity cannot simply be replaced. "Stolen medical data can't simply be canceled and replaced. That makes it especially valuable and long-lasting in criminal markets."
The impact may not show up right away. "The impact isn't always immediate; it can surface months or even years later."
How hospitals can strengthen defenses
Identity now sits at the center of cybersecurity. "Identity has become the front line of cybersecurity. If an attacker can successfully impersonate a trusted user, many traditional defenses can be bypassed," Amper said. Stronger identity verification, layered authentication and systems that can detect impersonation or deepfakes are becoming essential. The more certain a hospital is about who is accessing its systems, the harder it becomes for attackers to move quietly.
How to check if your information is on the dark web
After a hospital breach, many patients worry about whether their data has been sold or shared. One simple step is checking whether your email address appears in known data breaches. You can visit haveibeenpwned.com and enter your email address into the search bar. The site will show whether your information has appeared in past breaches tied to that email. If your email appears in a breach, take action immediately. Change passwords for affected accounts and make sure each account uses a unique password.
What patients should do after a hospital breach
If you receive a breach notification letter, do not panic. But do act. Amper offers clear guidance. "First, stay calm but take it seriously. Read the notice carefully and enroll in any credit or identity monitoring services offered."
Then take practical steps right away:
- Review insurance statements for unfamiliar claims
- Check medical records for incorrect diagnoses or procedures
- Monitor your credit reports
- Consider placing a free credit freeze with the major credit bureaus if your Social Security number was exposed
- Enable two-factor authentication (2FA) on email, financial and healthcare accounts wherever it is available
- Be cautious of emails or calls referencing the breach
- Reducing the amount of personal information available on data broker sites with a data removal service can also limit how easily scammers craft convincing follow-up attacks using your real details. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
"If something feels off, contact the hospital directly using official contact information. Don't rely on links or numbers provided in unexpected messages." He adds one final reminder. "Take your medical identity as seriously as your financial identity. Monitor your records, question anything unfamiliar and stay alert."
Protect your accounts from long-term damage
Even if everything appears normal right now, take steps to secure your accounts. Credential leaks often surface weeks or months later.
- Consider identity theft protection. Identity monitoring services can alert you if criminals try to open accounts in your name or misuse your personal information. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com
- Stop reusing passwords immediately. If attackers gain access to one working login, they often test it across dozens of websites automatically.
- Change reused passwords first, starting with email, financial and cloud accounts. Each account should have its own unique password.
- Consider using a password manager to generate and store strong passwords securely. You can also use breach scanning tools that alert you if your email address or passwords appear in future leaks. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.
- Install strong antivirus software on your devices to help detect malware, phishing links and credential-stealing threats that could target you after a breach. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.
Taking these steps now can prevent a hospital breach from turning into long-term identity damage later.
About Fox News
FOX News Channel (FNC) is a 24-hour all-encompassing news service and has been the number one network in basic cable for the last eight years and the most-watched television news channel for 22 consecutive years.