Infostealer statistics · Hospitals and health systems · October 2026
95.8% of the 48 hospitals and health systems in the Ransomnews panel have employee credentials in stealer logs in the October 2026 snapshot, against 89.4% across all 36 countries. The median organisation in the sector has 44.5 such credentials in circulation (31 panel-wide), 339 were captured in the 30 days before the snapshot, and 50.0% of organisations gained at least one. Hospitals and health systems rank 4th of 21 sectors with ten or more organisations by the share of organisations exposed and 8th by credentials per organisation.
How hospitals and health systems compare with the rest of the panel
Hospitals and health systems are more exposed than the panel as a whole: 95.8% of them have at least one employee credential captured by infostealer malware, against 89.4% across the panel, and the median organisation carries 44.5 credentials against 31. The distribution is long-tailed: 2 organisations have no employee credentials in the index, 21 have a hundred or more and 2 have a thousand or more. 14 organisations gained new credentials in the final seven days before the snapshot.
Lifetime totals accumulate over years of captures; the 30-day and 7-day figures are the measure of current activity. A stealer-log record is produced on an infected device, usually a personal or unmanaged machine where an employee saved work passwords in the browser; it means that credential is in criminal hands, not that the organisation’s own systems were breached.
Where are hospitals and health systems most exposed?
Hospitals and health systems are most exposed in United States, where 100.0% of the 15 measured have employee credentials in stealer logs and the median organisation carries 582, and least exposed in Brazil, at 66.7% of 3 with a median of 234. Countries with only a handful of organisations in this sector are listed but should be read with care.
| Country | Organisations | Hit rate | Median per org | Employee credentials | New in 30 days | Gained new in 30 days |
|---|---|---|---|---|---|---|
| Saudi Arabia | 1 | 100.0% | 1,870 | 1,870 | 75 | 100.0% |
| Netherlands | 1 | 100.0% | 784 | 784 | 33 | 100.0% |
| Turkey | 1 | 100.0% | 691 | 691 | 50 | 100.0% |
| United States | 15 | 100.0% | 582 | 6,364 | 90 | 66.7% |
| Mexico | 2 | 100.0% | 498.5 | 997 | 30 | 100.0% |
| France | 1 | 100.0% | 210 | 210 | 7 | 100.0% |
| United Arab Emirates | 2 | 100.0% | 194.5 | 389 | 10 | 50.0% |
| India | 1 | 100.0% | 127 | 127 | 16 | 100.0% |
| Ireland | 1 | 100.0% | 56 | 56 | 1 | 100.0% |
| Germany | 2 | 100.0% | 41 | 82 | 0 | 0.0% |
| South Africa | 3 | 100.0% | 33 | 110 | 3 | 66.7% |
| Australia | 1 | 100.0% | 21 | 21 | 0 | 0.0% |
| Norway | 1 | 100.0% | 14 | 14 | 0 | 0.0% |
| Singapore | 1 | 100.0% | 14 | 14 | 0 | 0.0% |
| Denmark | 4 | 100.0% | 13.5 | 55 | 1 | 25.0% |
| South Korea | 1 | 100.0% | 13 | 13 | 0 | 0.0% |
| Lithuania | 3 | 100.0% | 12 | 28 | 0 | 0.0% |
| Sweden | 1 | 100.0% | 9 | 9 | 0 | 0.0% |
| United Kingdom | 1 | 100.0% | 8 | 8 | 0 | 0.0% |
| Nigeria | 1 | 100.0% | 4 | 4 | 0 | 0.0% |
| Brazil | 3 | 66.7% | 234 | 479 | 23 | 66.7% |
| Portugal | 1 | 0.0% | 0 | 0 | 0 | 0.0% |
Hit rate: share of organisations with at least one employee credential in stealer logs. Consumer mailbox hosts are excluded from employee figures. Source: Ransomnews Infostealer Exposure Dataset, October 2026.
Why no organisations are named
Hospitals and health systems are reported in aggregate only. Naming an exposed hospital, university or government body serves attackers more than defenders, so the per-organisation tables on this site cover companies alone. Any organisation can check its own domain with Stealercheck.
What do the stolen employee logins open?
A stealer takes every password saved on the infected machine, so the log that holds an employee’s email login usually holds their logins to the organisation’s cloud services too. Across the 32 organisations in the sector with such records, the services most often captured alongside a work email address are Salesforce CRM, Okta and Webex (Cisco). By category, CRM (35.7%), Identity & Access Management (12.3%) and Video Conferencing (12.1%) lead.
Third-party services, by captured logins
By category
| Category | Logins | Organisations | Share |
|---|---|---|---|
| CRM | 782 | 8 | 35.7% |
| Identity & Access Management | 269 | 3 | 12.3% |
| Video Conferencing | 266 | 14 | 12.1% |
| Marketing & Creative | 112 | 11 | 5.1% |
| Project Management | 79 | 5 | 3.6% |
| Cloud Storage | 61 | 7 | 2.8% |
| Contact Center Software | 58 | 1 | 2.6% |
| Email Security & Archiving | 40 | 3 | 1.8% |
| ERP | 37 | 5 | 1.7% |
| Digital Learning | 32 | 1 | 1.5% |
| Whiteboarding | 29 | 9 | 1.3% |
| Construction & Design | 29 | 5 | 1.3% |
Service counts are summed from each organisation’s 25 largest services; categories are the index’s own labels, lightly consolidated. An identity-provider login (Okta, Entra, Ping) is the most dangerous record in this table: it opens every application behind the organisation’s single sign-on, and the stealer usually captures the session cookie next to it.
How to use these figures
Check your own domain with Stealercheck, which returns the same lifetime, 30-day and 7-day counts, and compare the result with the median above (44.5 for hospitals and health systems). For every exposed account: reset the password, revoke active sessions so stolen cookies stop working, re-enrol MFA and find the infected device. Then block browser password saving for work accounts in favour of a managed password manager and shorten session lifetimes on single sign-on. The controls that stop the infection itself are in our guide to ransomware protection for business.
Frequently asked questions
How many hospitals and health systems have employee passwords in stealer logs?
95.8% of the 48 hospitals and health systems measured in the October 2026 snapshot have at least one employee credential captured by infostealer malware, with a median of 44.5 per organisation; 339 new employee credentials were indexed in the 30 days before the snapshot and 50.0% of organisations gained at least one.
In which country are hospitals and health systems most exposed to infostealers?
United States: 100.0% of the 15 organisations measured have employee credentials in stealer logs, with a median of 582 per organisation. Brazil is the least exposed at 66.7%.
Which services do stolen logins from hospitals and health systems open?
The third-party services most often captured alongside work email logins in the sector are Salesforce CRM, Okta and Webex (Cisco); by category, CRM (35.7%), Identity & Access Management (12.3%) and Video Conferencing (12.1%) lead. An identity-provider login opens everything behind single sign-on and should be treated as an incident on its own.
Where do these sector figures come from?
From the Ransomnews Infostealer Exposure Dataset: a monthly query of the Alerts.bar stealer-log index for a fixed panel of 1,874 organisation domains in 36 countries, of which 48 are hospitals and health systems. Only aggregate counts are stored; no credential or personal record is kept or shown. The index is operated by the same group as Ransomnews. Cite as Ransomnews Infostealer Exposure Dataset, with a link to this page.
More infostealer statistics
- Infostealer statistics: families, countries and sectors
- Stealercheck: check any domain against the same index
- Ransomware statistics: confirmed attacks by month
By country
- Australia91.2%
- Austria90.7%
- Belgium90.5%
- Brazil95.1%
- Canada91.5%
- Czechia81.6%
- Denmark84.8%
- Estonia67.7%
- Finland86.7%
- France94.5%
- Germany92.7%
- India94.2%
- Ireland80.0%
- Israel93.8%
- Italy91.3%
- Japan82.1%
- Latvia72.4%
- Lithuania72.9%
- Mexico92.7%
- Netherlands87.0%
- Nigeria87.8%
- Norway85.0%
- Poland93.2%
- Portugal94.3%
- Saudi Arabia97.5%
- Singapore82.6%
- South Africa96.7%
- South Korea88.5%
- Spain95.7%
- Sweden79.6%
- Switzerland93.5%
- Turkey97.9%
- Ukraine78.6%
- United Arab Emirates84.8%
- United Kingdom90.4%
- United States98.6%
By sector
- Airlines and transport95.6%
- Automotive82.1%
- Banking and finance88.7%
- Consumer goods81.7%
- Defence and aerospace89.5%
- E-commerce96.2%
- Gaming94.1%
- Government76.3%
- Healthcare95.8%
- Industrial87.1%
- Insurance85.4%
- Logistics and post91.2%
- Media97.8%
- Mining93.3%
- Oil, gas and energy92.5%
- Pharmaceuticals94.3%
- Retail78.0%
- Technology94.1%
- Telecoms89.4%
- Universities99.3%
- Utilities94.7%
Method. Figures come from the October 2026 snapshot of the Alerts.bar infostealer index, taken for a fixed panel of 1,874 organisation domains in 36 countries and stored by Ransomnews; the panel is held constant so that month-on-month change reflects the threat rather than the sample. Employee credentials are stealer-log records whose username is an address on the organisation’s domain (university figures include students); customer logins are credentials captured on the organisation’s own login pages; session cookies are authentication cookies harvested from infected browsers. The index reports a floor of 1 on lifetime counters, which we record as 0, and domains that host consumer mailboxes are excluded from employee figures. Full methodology and the public API: infostealer statistics. Cite as: Ransomnews Infostealer Exposure Dataset, ransomnews.com.