Healthcare tops India’s 2024 cyberattack list, warns Seqrite in new report

The report highlights a sharp rise in ransomware attacks, phishing campaigns, and malware disguised as medical software, with sophisticated groups like LockBit 3.0 and RansomHub targeting healthcare infrastructure, encrypting patient records, demanding ransom, and threatening patient care and operations

The Indian healthcare sector emerged as the most targeted industry for cyberattacks in 2024, accounting for 21.82% of total incidents, according to the latest India Cyber Threat Report 2025 released by Seqrite, the enterprise security arm of Quick Heal Technologies.

The findings, compiled by researchers at Seqrite Labs—India’s largest malware analysis facility—highlight the growing vulnerabilities in healthcare institutions as they rapidly adopt digital technologies. With vast amounts of sensitive patient data and mission-critical systems, hospitals and healthcare providers have become key targets for ransomware groups and cybercriminals.

The report identifies a sharp rise in ransomware attacks, phishing campaigns, and malware disguised as legitimate medical software. Sophisticated ransomware groups such as LockBit 3.0 and RansomHub were found targeting critical healthcare infrastructure, encrypting patient records and demanding ransom to restore access—posing a direct threat to patient care and operational continuity.

In 2024, behaviour-based malware attacks accounted for 14.5% of all threats in healthcare. These threats are particularly dangerous because they mimic normal software behaviour to evade traditional security systems. Seqrite researchers found that cybercriminals increasingly exploited hospital networks, telemedicine platforms, and Internet of Medical Things (IoMT) devices.

The report also notes that phishing campaigns impersonating health agencies and insurance companies successfully compromised 37% of healthcare staff. These campaigns use social engineering techniques to trick employees into revealing credentials or downloading malicious files.

To address these evolving threats, Seqrite emphasized the need for robust, real-time security infrastructure. Its Endpoint Security (EPS) solution—recognized by AV-TEST for its corporate-grade performance—uses behaviour-based detection, cloud sandboxing, and automated rollback to combat ransomware attacks. For organizations using connected medical devices and cloud-based systems, Seqrite’s Extended Detection and Response (XDR) platform provides integrated monitoring across endpoints, networks, and cloud environments. The platform also supports AI-powered threat hunting, based on data collected from 8.44 million analyzed endpoints.

In response to the growing use of generative AI, deepfakes, and cloud misconfigurations in cyberattacks, Seqrite has introduced new innovations, including the Seqrite Threat Intelligence Platform and the Seqrite Malware Analysis Platform (SMAP), to give enterprises better visibility and faster response capabilities.