The Urgent Need for Hypervisor Security in Healthcare

Originally published by Vali Cyber.

Healthcare organizations increasingly rely on virtualization to consolidate infrastructure, streamline IT, and improve patient care. But this shift comes with a growing risk: hypervisors have become key targets for ransomware groups exploiting the very systems that support critical care delivery. This blog explores how and why healthcare’s growing reliance on virtual infrastructure has introduced a new class of threats—and what steps can be taken to secure the hypervisor layer before lives are at stake.

From electronic health records (EHRs) to medical imaging and telemedicine, modern healthcare runs on virtual machines—coordinated by hypervisors. As the control plane for these workloads, the hypervisor is a uniquely valuable target. Yet many healthcare environments lack dedicated protections for this layer, making it an increasingly common entry point for ransomware groups like BlackCat. Securing hypervisors isn’t just a technical imperative—it’s critical for patient safety and continuity of care.

Why healthcare?

Healthcare is uniquely vulnerable: organizations manage highly sensitive data, rely on real-time access, and often lack the resources for advanced cyber defense. Once inside a hypervisor, attackers can encrypt all connected virtual machines—paralyzing hospitals and forcing ransom payments to resume care. In fact, 53% of healthcare institutions reported paying ransoms in 2024, with an average payment of $4.4 million. These financial incentives, paired with urgent care demands, make the sector a repeat target.

Resource constraints also contribute to risk. Many healthcare providers operate without dedicated security operations centers, relying on small IT teams to manage both operations and cybersecurity. A 2024 report found 52% of healthcare respondents were concerned about vulnerabilities stemming from employee error alone. Without specialized tools or training focused on hypervisor security, these systems remain exposed to advanced threats.

The scope

Ransomware continues to hammer the healthcare sector. As of 2024, institutions faced nearly 2,000 attacks per week—a 15% increase year over year. One of the most disruptive came in February 2024, when Change Healthcare suffered a cyberattack attributed to the BlackCat group, which has previously targeted ESXi hypervisors. The breach affected over 100 million individuals, disrupted pharmacies, and impacted care delivery across a third of the U.S. healthcare system.

The financial cost is only part of the damage. With the average ransomware incident now costing $9.8 million, 37% of providers report taking over a month to recover. Downtime costs the sector approximately $900,000 per day—contributing to an estimated $10 billion in losses over just four years.

Real-World Consequences

A recent study revealed the ripple effects of ransomware on healthcare delivery. Following such incidents:

• Stroke activations increased by 75%
• Cardiac arrest incidents rose by 81%
• Survival rates for out-of-hospital cardiac arrests dropped from 40% to just 4.5%

Unaffected hospitals experienced longer wait times, higher walkouts, and longer stays. These impacts highlight that hypervisor ransomware in healthcare is more than a technical threat—it can have life-threatening consequences.

Next steps

These scenarios emphasize the urgent need for healthcare organizations to implement a hypervisor-aware security strategy. In a sector where cyberattacks do more than compromise data—they disrupt care and put lives at risk—proactive defense is essential.

Providers should approach hypervisor protection as a core pillar of patient care by adopting:

• Multi-layered security architectures for virtual infrastructure
• Threat detection at the hypervisor level
• Access controls and privilege restrictions
• Full-disk encryption and secure backup practices
• Regular training for IT and clinical staff

A proactive approach to cybersecurity is so much more than safeguarding patient data; it’s about protecting lives and preserving trust in an era where health and technology are inextricably linked.