Hive’s takedown removed a supplier, not the ransomware market

The week

For months in late 2022, some of the victims of one of the world’s most active ransomware gangs had help they did not know about. Ransomware is malicious software that scrambles an organization’s files and systems so they cannot be used, followed by a demand for payment in exchange for the digital key that unscrambles them. The key is called a decryption key. Without it, the victim either restores from its own backups or pays.

Hive was well known to defenders by then. It had appeared in June 2021 and grown fast. In November 2022 the FBI, CISA and the Department of Health and Human Services issued a joint advisory on it, AA22-321A. According to that advisory, Hive actors had hit more than 1,300 companies worldwide and received about $100 million in ransom payments. It said the group had heavily targeted the healthcare and public health sector.

The advisory also described how Hive’s attackers worked. They got in through remote desktop and VPN accounts protected only by a password, and through a known flaw in Fortinet’s FortiOS that let them skip multi-factor authentication. Phishing attachments and unpatched Microsoft Exchange servers were other routes. Once inside, they stopped backup and antivirus processes and deleted Windows shadow copies, the built-in snapshots used to roll files back. They cleared event logs and copied data out before encrypting.

Victims were sent to a chat page on the Tor network to negotiate, and threatened with publication of their data on a leak site called HiveLeaks. The advisory said the actors had reinfected some networks that were restored without paying. It also gave hospital security teams a list of Hive indicators to load into their tools.

On January 26, 2023, the Justice Department announced that the FBI, working with German and Dutch authorities, had disrupted the Hive ransomware group and seized the servers and websites it used. According to the department, the FBI had been inside Hive’s network since July 2022. From that vantage point it had obtained keys and given more than 300 decryption keys to victims under attack and more than 1,000 to earlier victims, preventing about $130 million in ransom payments.

The scale of Hive’s activity was striking. The department said Hive had targeted more than 1,500 victims in over 80 countries, including hospitals, school districts, financial firms and critical infrastructure, the essential services such as power and water that a society depends on.

The Attorney General and the FBI Director made the announcement at a press conference in Washington. The two sets of figures measured different things. The November advisory counted victims and ransoms already paid. The January announcement counted victims over Hive’s lifetime and ransoms that were never paid because the FBI had supplied keys. Read together, they suggest the covert operation reached a meaningful share of Hive’s activity in its final months.

The final phase was public. With court authorization, investigators took control of Hive’s servers and replaced its leak site with a seizure notice. The announcement did not include any arrests. The people who wrote and ran Hive, and the affiliates who rented it, remained at large.

Hive ran as ransomware-as-a-service. In this model, a core group writes and maintains the malicious software and the systems for collecting payments, then rents those tools to affiliates, independent criminals who do the actual breaking in. It works like a franchise: the brand supplies the kit, the franchisees run the operations, and the proceeds are shared.

The announcement cited a Hive attack on a Midwest hospital that left it unable to accept new patients. That single detail captures why ransomware is different in healthcare. In most industries, an attack stops business. In a hospital, it can stop care.

The news was welcome, and it was a genuine achievement. What it actually changed for hospitals was less obvious.

Take a hospital chief executive reading the Hive announcement over coffee. Hive had been on the threat briefing the board saw last quarter. Now its servers had been seized, and victims had received keys for free. It would be natural to feel that the danger had receded.

The Hive operation was new in one respect: investigators sat inside a ransomware group’s infrastructure for months, handing keys to victims without the group noticing. For hospitals it was welcome news. It was also easy to misread as a change in the threat.

The takedown affected three things very differently: the specific group, the ransomware economy around it, and each hospital’s own exposure. Only the first was materially reduced. The reason lies in how a ransomware attack actually unfolds.

Weeks inside the network before the ransom note

Most people see ransomware as a single event: a screen goes red, files are locked and a ransom note appears. In reality, that moment is the end of a process that often takes days or weeks.

Getting in

Attackers first need a way into the network. Common routes include remote access systems, the tools that let staff and vendors log in from outside the building, protected only by a password. Others include edge devices, the equipment such as firewalls and virtual private network gateways that sits at the boundary between the hospital’s network and the internet. If one of those devices has a known flaw that has not been patched, an attacker can walk through it. Stolen credentials, meaning usernames and passwords taken through phishing emails or bought from other criminals, are another favorite.

Moving around

Once inside, attackers explore. They use legitimate administrative tools, the same ones the hospital’s own IT team uses, to move from one computer to another. This is called lateral movement. Because the tools are legitimate, their use does not always look suspicious. The attackers’ goal is to gain the highest level of access, often the accounts of domain administrators, the people who can control almost every computer on the network.

Taking and destroying

Before launching the main attack, they usually do two more things. They copy sensitive data out of the network, so they can threaten to publish it. And they find the backups and delete or encrypt them, so the victim cannot simply restore and move on. Only then do they trigger the encryption that locks the systems, and present the demand.

Because the intruders spend days or weeks inside before taking anything, the damage is extensive when it arrives. The same delay also gives defenders many chances to notice and stop them along the way.

What Hive’s affiliates actually did

The November 2022 advisory makes the sequence concrete. Its list of entry points reads like a hospital audit finding. Remote desktop and VPN accounts needed only a password. A FortiOS flaw let attackers skip multi-factor authentication on unpatched devices. Phishing attachments and Exchange servers missing months-old patches did the rest. Every one of them used a weakness that was already known.

The steps after entry are equally specific. The actors stopped the processes that run backups and antivirus software. They deleted Windows volume shadow copies, the snapshots that let an administrator roll a file back to an earlier version. They cleared the System, Security and Application event logs, which erases much of the record an investigator would use. They moved data out with ordinary file-transfer and cloud storage tools, the same kind a hospital’s own staff might use.

Where a defender gets a chance

Each of those steps is a detection opportunity, and several are unusual enough to justify waking someone up.

• A remote access login without a second factor from an unfamiliar location or at an odd hour.
• A new account added to a powerful administrative group, which in a well-run domain happens rarely and through a change ticket.
• Shadow copies deleted on many machines at once, an action ordinary users and most administrators never take.
• Security event logs cleared on a server, which almost never has an innocent explanation in production.
• Large outbound transfers to a cloud storage service the hospital does not use, especially at night.

Every one of these signals works whatever the attacker calls itself. A hospital whose monitoring raises them, and whose on-call staff act within the hour, turns the attacker’s long stay inside the network into its own advantage.

The specific group

Hive itself was finished as a brand. Its leak site, where it published stolen data to pressure victims, went dark, its infrastructure was seized, and its affiliates lost the platform they had rented. Victims caught mid-attack in late 2022 recovered without paying. That outcome was real, and the numbers the Justice Department published were large.

For a hospital’s security team, the direct effect was narrow. Detection rules and indicator lists written for Hive’s specific malware lost most of their value overnight. Indicators are the digital fingerprints of a particular tool or group: specific file signatures, internet addresses and servers. They are useful while the group exists and nearly useless once it is gone. Threat briefings to boards that named Hive as a top risk needed updating. Any hospital that had been hit by Hive and still held encrypted data had a reason to ask the FBI whether a key existed.

The trade-off inside the covert phase

The operation involved a choice that deserved more attention than it received. Keeping access for months, and handing keys to victims as attacks unfolded, saved many organizations from paying. It also meant Hive’s platform kept running during those months, so its affiliates kept breaking into networks and stealing data. Keys could undo the encryption. They could not undo the theft.

The benefit also reached only victims the FBI could identify and contact. A hospital that called its local FBI field office early in an incident was in a position to be offered help. One that handled an attack entirely through private responders, without telling law enforcement, may never have learned that a key existed. Incident response plans should name who contacts law enforcement, at what point and through which office. That decision belongs in the plan, made in advance, and should not be left to judgment on the day.

A free key does not end the HIPAA analysis

Since 2016, guidance from the HHS Office for Civil Rights has said that encryption of protected health information by ransomware is presumed to be a breach under HIPAA. The hospital, or the business associate, can overcome that presumption only by showing a low probability that the information was compromised, through a documented risk assessment. A key changes how fast systems come back. It does not change that assessment, which turns on what the attackers could see and take while they were inside.

For a hospital that received a Hive key, the evidence that mattered was the forensic record: which systems the intruders reached, which accounts they used and whether data left the network. Hive’s log clearing was designed to destroy that record. Hospitals that sent logs to a separate, protected store kept the ability to answer the question. Those that kept logs only on the affected servers were more likely to have to assume the worst and notify accordingly.

What the operation proved, and what it did not

The more important effect was on decision-making. The operation showed that payment is not the only path to recovery. That strengthens the position of executives who prefer not to pay.

It does not help a hospital that has no usable backups when the next attack arrives, because keys from a law enforcement operation are a rare outcome rather than a recovery plan.

Decryption keys also do nothing about stolen data. Most groups by then copied records before encrypting them, so a hospital that recovered its systems for free could still face extortion, breach notification under HIPAA and litigation over the same incident. HIPAA is the federal law that protects patients’ health information; when that information is exposed, it generally requires the hospital to notify those affected. Getting systems back is one problem. Getting data back is impossible once it has been copied.

The ransomware economy

Ransomware-as-a-service splits the work. Developers build and maintain the encryption tools, leak sites and payment systems. Affiliates break into networks, move through them and deploy the tools for a share of the ransom. Initial access brokers sell footholds to both: they specialize in getting into networks and then sell that access to whoever will pay.

Taking down one developer group removes a supplier. The affiliates keep their skills, their stolen credentials and their existing footholds, and they can sign up with another platform within weeks. Developers can rebrand with new code. Closing one franchise leaves its operators with every skill they had.

Why the platform is the weak link, and why it regrows

The economics explain both the value and the limits of a takedown. A ransomware brand earns its money from a reputation among victims: pay, and the decryptor works. That reputation is what lets negotiators demand large sums. It is also fragile. A platform that may be in police hands is one that affiliates hesitate to trust with their stolen access and their share of the proceeds.

The developer’s assets are mostly code and servers, and both can be replaced. Source code can be reused, sold or leaked, and a new brand name costs nothing to register on the dark web. The scarcer assets belong to the affiliates and access brokers: working credentials, footholds in specific networks and the skill to move inside them unnoticed. A takedown of the platform leaves those assets with their owners.

The strongest case against this reading

A fair objection is that takedowns do more than remove one supplier. They impose cost, because rebuilding infrastructure and recruiting affiliates take time and money. They sow distrust, because every affiliate now has to wonder whether its own platform is already compromised. They also produce intelligence, since seized servers can reveal affiliates, payment flows and victims who never came forward. Each effect is real, and together they probably raise the cost of doing business across the market for a while.

The argument here still holds for a hospital, for a narrower reason. Those effects act on criminals’ costs and confidence. They do not change whether a particular hospital’s VPN accepts a password alone, whether its backups survive an administrator account takeover, or whether its nurses can work on paper. A market under pressure may attack a little less often for a few months. The attacks that do arrive meet the same defenses as before.

Why group names are a poor basis for defense

That structure explains why group names are a poor basis for defense. The techniques Hive affiliates used were common across the market. They exploited exposed remote access and unpatched edge devices and logged in with stolen credentials. They used legitimate administrative tools to move laterally, and deleted or encrypted backups before launching the main attack.

Defenses aimed at those techniques stay useful whatever brand the attacker uses next. Defenses aimed at one group’s file hashes and infrastructure expire with the group. A file hash is a digital fingerprint of a specific file; change one character of the malicious code and the fingerprint no longer matches.

Changing how threat intelligence is used

For a health system, that suggests a shift in how threat intelligence is consumed. Ask providers and information sharing groups such as Health-ISAC, the health sector’s organization for sharing security warnings among members, for technique-level reporting, mapped to a common framework like MITRE ATT&CK. ATT&CK is a widely used public catalog of attacker techniques, a shared vocabulary that lets a report on one gang be translated into defenses against the behaviors that all gangs share.

Then test whether detection and response actually catch those techniques in the hospital’s own environment. A purple-team exercise that simulates credential theft and backup deletion tells a CISO more than a list of active gang names. In a purple-team exercise, one group plays the attacker (the red team) while the defenders (the blue team) watch in real time and learn what their tools did and did not see.

The mapping is concrete. The shadow-copy deletion described in the Hive advisory appears in ATT&CK as Inhibit System Recovery. Clearing event logs is a form of Indicator Removal. Logging in through a VPN or remote desktop service with stolen credentials falls under External Remote Services. A detection engineer with tested rules for those techniques is covered for Hive and for most of the groups that followed it. One with a feed of Hive file hashes was covered for Hive alone, and only while Hive existed.

Health-ISAC and the HHS Health Sector Cybersecurity Coordination Center both published material that hospitals could use this way. The useful habit is to read each new alert for its techniques first and its group name second, then check whether the hospital’s own monitoring would have caught each technique.

The hospital’s own exposure

The third element was untouched. A hospital’s attack surface, the sum of all the ways an attacker could get in, was the same the day after the announcement as the day before.

The conditions that made hospitals attractive remained. Clinical systems cannot tolerate long downtime, which raises pressure to pay. Medical devices and business systems often share flat networks, meaning networks without internal walls, where a computer at the registration desk can reach the pharmacy system. Many vendors hold remote access. Security teams are small relative to the estate.

The slow work that reduces exposure

The work that reduces exposure is familiar and slow. It starts with multi-factor authentication on every remote access path, including accounts used by device manufacturers, revenue cycle partners and other vendors. Multi-factor authentication requires a second proof of identity beyond the password, such as a code on a phone or a physical key. The strongest forms, called phishing-resistant, cannot be tricked out of a user by a fake login page.

It needs backups that cannot be deleted with the same administrative credentials attackers obtain inside the network, such as immutable or offline copies with separate credentials. An immutable backup is one that cannot be changed or erased for a set period, even by an administrator. An offline copy is physically disconnected from the network. Either way, the attacker who has taken over the network cannot reach it.

Segmentation should stop an intruder on a registration workstation from reaching imaging or pharmacy systems. And clinical downtime procedures need regular rehearsal, so care continues on paper for days if needed. Nurses and physicians who have practiced working without the electronic health record, the digital patient chart, can keep patients safe while systems are rebuilt.

The edge devices nobody patches fast enough

The FortiOS flaw in the Hive advisory illustrates a pattern that outlasted Hive. Firewalls and VPN gateways are exposed to the whole internet by design, and their flaws are published along with the fixes. Attackers scan for unpatched devices within days of a disclosure. Hospitals often patch them slowly, because a reboot of the main VPN gateway interrupts remote clinicians and vendors.

A practical answer is to treat edge devices as their own patch class, with a deadline measured in days for flaws known to be exploited. CISA’s Known Exploited Vulnerabilities catalog, created in November 2021 alongside a directive that binds federal civilian agencies, gives non-federal organizations a free, public list to prioritize against. A hospital does not have to follow the federal deadlines. Using the catalog as its own trigger for emergency patching costs almost nothing and removes a lot of debate.

The vendor door

Vendor access deserves particular attention because it is so easy to overlook. A hospital may have dozens of outside companies with some way into its network: device manufacturers who service imaging equipment remotely, billing and revenue cycle partners, software suppliers who troubleshoot the health record. Each connection was set up for a good reason, often years ago, by someone who may have moved on. Some are protected only by a shared password that several of the vendor’s staff know.

From an attacker’s point of view, these connections are attractive precisely because they are trusted. Traffic from a known vendor rarely raises alarms. Three steps are among the cheapest and most effective a hospital can take. Bring every vendor connection under the same strong authentication rules as staff. Keep a current list of who has access and why. Switch off connections that are no longer needed.

Contracts are where most of this gets enforced. A business associate agreement covers what a vendor may do with patient data, but it often says little about how the vendor connects. Hospitals can add terms that require named individual accounts rather than shared logins and a second factor on every session. Others can require connection only through the hospital’s own remote access gateway, and prompt notice when a vendor employee with access leaves. Renewal dates are the natural moment to add them, so a list of vendor contracts sorted by renewal date doubles as a remediation schedule.

Measuring what matters

Each item has a measurable target. Examples are the share of external access paths protected by phishing-resistant authentication, the time to restore the electronic health record from an isolated copy, and the number of network paths between clinical and business segments. Hospital boards can track those numbers quarterly. They mean more than a count of blocked attacks. Where a number is poor, the board can ask for a dated plan to fix it and check progress at the next meeting.

A fourth number is worth adding once monitoring matures: the time from a high-signal alert, such as shadow copies being deleted or a security log being cleared, to the moment someone isolates the machine. Attackers who reach that stage are hours from encryption. A hospital that measures this interval in minutes has a chance to stop the attack. One that measures it in days, because alerts wait for the next business morning, is relying on luck. Testing it is cheap: trigger a harmless version of the signal at 2 a.m. on a weekend and record what happens.

Three numbers instead of reassurance

Suppose that after the Hive news, a community hospital’s board asks whether the hospital is safer. The chief information security officer answers with three numbers instead of reassurance. Most, but not all, remote access paths use phishing-resistant sign-in; the gaps are two vendor accounts. The last full restore of the health record from an isolated copy was never timed. And the registration network can reach the pharmacy system. The board approves a plan with dates for each, and asks to see the same three numbers next quarter. Which gang attacks next makes no difference to any of it.

How the same exposure looks in different kinds of provider

The controls are the same everywhere, but the hard part differs by organization.

• Large health systems and academic medical centers have security teams and budgets, but also sprawl. Acquired hospitals arrive with their own directories, VPNs and vendor connections, and research networks are built for openness. The hard part is consistency: bringing every acquired site and research enclave up to one standard on a dated plan.
• Community and critical access hospitals often have a handful of IT staff and depend on outside providers for the health record, hosting and security monitoring. The hard part is contractual. The hospital must make sure the provider’s monitoring covers nights and weekends, and that the provider’s own remote tools are protected.
• Ambulatory networks and physician groups run many small sites, often on modest equipment, connected back to shared systems. The hard part is the edge: dozens of firewalls and remote access devices, each one a possible entry point if it misses a patch.
• Business associates, such as billing, coding and transcription firms, are directly subject to the HIPAA Security Rule. Many hold remote access into several hospitals at once, so one compromised account can open a path into every client.

The evidence an auditor or regulator would ask for

The HIPAA Security Rule requires covered entities and business associates to carry out an accurate and thorough risk analysis and to manage the risks it finds. Office for Civil Rights enforcement actions after ransomware incidents have repeatedly cited failures to do that analysis. A risk analysis that never considered stolen remote access credentials or deleted backups is a weak document to hand over after an attack.

Useful evidence is mundane. It includes a current inventory of remote access paths with the authentication each one uses, logs showing who used vendor accounts and when, and records of restore tests with the time each took. Attendance and findings from downtime drills belong in the file too. For hospitals in Medicare, CMS’s emergency preparedness requirements already call for an all-hazards plan, staff training and regular exercises. A multi-day loss of the health record is a natural scenario for one of those exercises, serving compliance and readiness at once.

What each control costs

Every item on the list has a price, and plans that ignore the price tend to stall. Strong authentication adds steps for clinicians who move between shared workstations many times a shift. Badge-tap sign-in and longer sessions on locked-down clinical devices reduce that friction but take engineering time. Segmentation breaks things at first. Older devices and interfaces often rely on network paths nobody documented, and the first attempt to close them can interrupt a lab feed or an imaging workflow.

Immutable backup storage costs more than ordinary storage. Rehearsing a full restore of the health record may need a test environment the hospital has never built. Downtime drills take nurses and physicians away from patients for hours. Each of these costs is easier to defend when it is tied to a specific attacker step it blocks.

The sensible order follows exposure. Remote access and vendor accounts come first, because they are the doors Hive’s affiliates used. Backup isolation comes next, because it decides whether an attack is an outage or a catastrophe. Segmentation and rehearsal follow, phased by clinical risk. A plan in that order, with costs attached, is easier for a board to fund than a list of everything at once.

Patients, money and reputation

Ransomware in a hospital is not primarily a technology problem. It is a patient safety, financial and reputational problem that happens to arrive through technology.

• Patients. As the Midwest hospital in the Justice Department’s announcement showed, an attack can leave a hospital unable to accept new patients. Diverted ambulances and delayed procedures are clinical harms.
• Money. Recovery, lost revenue during downtime, legal costs and the ransom itself, if paid, can each be substantial.
• Regulators and litigation. Stolen health data triggers notification duties and can lead to lawsuits, whatever happens with the encrypted systems.
• Staff. Clinicians working on paper for days under pressure are exhausted and at greater risk of error. Rehearsal reduces both.
• Reputation. Communities judge a hospital by whether care continued and whether patient information was protected.

The notification clock adds its own pressure. Under the HIPAA Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. Breaches affecting 500 or more people must also be reported to HHS, and to prominent media outlets when more than 500 residents of a state or jurisdiction are affected. Those deadlines run while the hospital is still restoring systems, so the team that handles notification needs to start work in the first days of an incident, alongside recovery.

A takedown also creates a short window of attention. Boards ask questions, and budget conversations are easier. That moment is better spent funding the slow work than issuing reassurance.

A hospital should also settle in advance, with its executives and counsel, how a ransom decision would be made, who makes it, and what information they would need. Those choices do not depend on which group attacks next. The decision involves more than money. Counsel will need to weigh legal restrictions on payments to certain groups, insurers may have views and requirements, and clinical leaders must judge how long patients can safely be cared for without the affected systems. Writing down who sits at that table, and what each person needs to know, turns a frantic improvisation into a structured choice. Making them for the first time at 3 a.m., with systems down and patients waiting, is the worst possible setting.

The constraints on a ransom decision

Two outside constraints shape that decision. The first is sanctions. The Treasury Department’s Office of Foreign Assets Control warned in an updated advisory in September 2021 that paying a ransom to a sanctioned person or group can violate US sanctions law. That applies even when the payer did not know who was behind the attack. OFAC said it would treat prompt reporting to law enforcement and full cooperation as significant mitigating factors, which is one more reason to settle in advance who calls the FBI and when.

The second is insurance. Cyber policies differ on whether and how they cover ransom payments, which response firms the hospital must use and how quickly the insurer must be told. A hospital that discovers those terms during an incident loses hours it cannot spare. Counsel, the risk manager and the security lead should read the policy together beforehand, and the incident plan should carry the insurer’s notification steps.

Defending against methods, not brands

The hospitals in the strongest position organized their defenses around attacker techniques and tested whether their tools caught them, because brands come and go while the methods persist. Every remote access path, including those used by vendors, required strong multi-factor authentication; vendor remote access is often the least protected door into the building. At least one backup copy sat out of reach of the network’s own administrator accounts, since attackers look first for backups on the same network, and restores were timed. Clinical and business networks were separated, with the remaining connections known and justified. Clinical downtime procedures were rehearsed, and the ransom decision process was agreed in advance. Each also knew, before any breach, its notification duties if patient data were stolen, and who would lead that work.

Two misreadings were common. One treated decryption as the end of the incident, though stolen data creates obligations and pressure long after systems are restored. The other used good news to relax, when a takedown is a reason to fund the work rather than defer it.

A third misreading was subtler. It assumed that because federal agents had stepped in once, they would step in again. Law enforcement keys reached Hive’s victims because of an unusual operation that took months to build. Later victims could not count on the same help, and a recovery plan that depends on outside rescue is a hope.

A first ninety days

For a hospital starting from a weak position, a reasonable response to a briefing like the Hive one is modest and sequenced. In the first week, list every external access path, including vendor accounts, and switch off the ones nobody can justify. In the first month, require a second factor on every remaining path, beginning with administrator and vendor accounts. In the second month, copy backups of the health record and Active Directory to storage the domain administrators cannot reach, and time a restore. In the third month, run a tabletop exercise with clinical leaders on a week without the health record. Each step produces a number the board can see.

Attacker methods, not gang names, belong in the quarterly security review

1. Does our threat reporting describe what attackers do, or only who they are?
2. What share of our remote access paths, including vendors’, use phishing-resistant authentication, and when will the rest?
3. Could an attacker with our top administrator accounts delete every backup we have, and how long would it take to restore the electronic health record from an isolated copy?
4. When did our clinical teams last rehearse working on paper, and for how long could they sustain it?
5. Who decides whether to pay a ransom, with what advice, and on what information?

These questions were as relevant the week Hive fell as they are every quarter, whichever names appear in the next briefing.

With hindsight

The pattern repeated at larger scale. Law enforcement disrupted ALPHV/BlackCat in December 2023 and LockBit in February 2024. Each operation was celebrated, and each removed a brand.

The ALPHV case showed the cost of a partial disruption. When the Justice Department announced its action against ALPHV in December 2023, the FBI offered a decryption tool to hundreds of victims. The group’s administrator responded by urging affiliates to attack hospitals. A joint advisory from the FBI, CISA and HHS, updated in February 2024, reported that healthcare had been the most frequently victimized sector among the nearly 70 victims ALPHV had published since mid-December.

Operation Cronos, the UK-led action against LockBit in February 2024, went further than the Hive operation. According to the National Crime Agency, investigators took over LockBit’s administration platform and leak site, obtained its source code and more than 1,000 decryption keys, and took down 28 servers belonging to affiliates. LockBit’s operators still put up a new leak site within days. Even the most thorough takedown of the period dented a brand without ending the trade.

On February 21, 2024, an affiliate working with ALPHV attacked Change Healthcare, halting claims processing and many pharmacy transactions across the US for weeks. Because so many claims and pharmacy transactions ran through Change Healthcare, its outage reached organizations that had never been attacked themselves. ALPHV’s operators then shut down, reportedly keeping a ransom payment from the affiliate, while the stolen data stayed in criminal hands. In April 2024 UnitedHealth Group said the stolen files could cover a substantial proportion of people in America.

The entry point was familiar. UnitedHealth’s chief executive told the Senate Finance Committee in May 2024 that the attackers had used compromised credentials on a remote access portal without multi-factor authentication. He also confirmed that the company had paid a ransom. It was the same kind of door the Hive advisory had described in 2022.

Hospitals themselves kept paying the clinical price. In May 2024 a ransomware attack on Ascension, one of the largest US health systems, disrupted its electronic health record. Some of its hospitals diverted ambulances and worked on paper for weeks.

The episode confirmed that disrupting a brand does not remove its affiliates, and that a single third party can carry risk for much of the sector. An earlier takedown of ALPHV did not prevent its affiliate from carrying out the attack. The stolen data stayed out of reach whatever happened between the criminals. And organizations that had not been breached themselves still saw claims and prescriptions disrupted by an attack on a company they relied on.

That second point extends the argument made after Hive. A hospital’s exposure includes its own network and also the handful of outside services it cannot operate without. Hospital executives should know which those are, what the hospital would do if each disappeared for weeks, and how cash flow would hold up if claims could not be processed.

HHS published voluntary cybersecurity performance goals for healthcare in January 2024, giving hospitals a common reference for basic and enhanced protections. They point in the same direction as the measures above.

At the end of 2024 HHS went further and proposed amendments to the HIPAA Security Rule. The proposal would make several of these measures explicit requirements for covered entities and business associates. They include multi-factor authentication, network segmentation, an asset inventory and the ability to restore certain systems within 72 hours. Hospital associations objected to the cost and asked HHS to withdraw it. Whatever form a final rule takes, it points the same way the Hive episode did.

The takedowns also changed the argument about paying. Each operation that produced free keys, and each brand that vanished after taking a victim’s money, weakened the case that a ransom buys a reliable outcome. ALPHV’s reported exit after the Change Healthcare payment, with the stolen data still in criminal hands, made that plain.

The technique-focused defenses and recovery targets above remain the measures that matter in 2026. Gang names in threat briefings have changed several times since Hive fell. The questions a board should ask about remote access, backups, segmentation and rehearsed downtime have not.