Blast from the past: Remember Hafnium? Suspect arrested 4 years on
Chinese cybercrime suspect takes vacation to Italy. Now faces a much, much longer side-trip to the US.
Each year, dozens of organizations release reports naming the most targeted industries for cyberattacks. These reports examine the volume and severity of attacks; and, year after year, healthcare, financial services, manufacturing, and education are named the most targeted industries because attackers can count on a big payout.
We’ve talked a lot about how attackers don’t discriminate. While it’s true that attackers run automated attacks which target companies big and small, they do focus their efforts on specific industries that, by nature, are more susceptible to attack. The reasons range from limited budgets and staffing gaps to legacy infrastructure. Others are targeted because they can’t afford downtime or because they hold sensitive or valuable data.
Regardless of the why, when bad actors look at an industry, they’ve undoubtedly already had success breaking in and stealing valuable information. So now is the time for executives to take action. Here’s a breakdown of why each industry is targeted by cyber criminals and what executives can do about it.
It’s no surprise that healthcare tends to top the lists of the most targeted industries for cyberattacks. According to IBM, last year the average cost of a data breach in the healthcare industry was $7.42 million. That’s not only the highest average cost among all industries analysed, but it has held that title for the last 14 years.
One of the contributing factors to the high cost of healthcare data breaches is the aggressive use of ransomware. The FBI confirmed that healthcare was the top target for ransomware attacks in 2025, with 460 incidents. This is a strategic move for hackers.
Hospitals and healthcare organizations can’t afford to stop operations. If a healthcare system can’t access patient records during an emergency, the patient’s life is at risk. If doctors and nurses can’t manage healthcare equipment or run diagnostic tests, treatment may be delayed. And, if bad actors threaten to release sensitive patient information, practices could face a major HIPAA violation. Bad actors use this knowledge to pressure hospitals, private practices, and healthcare systems to pay large ransoms fast. The FBI notes that several ransomware gangs have built their entire business around pressuring healthcare systems to pay ransoms in order to get their operations back online.
Not only are healthcare systems more likely to pay ransoms fast, but their data is also more valuable on the black market. Declassified U.S. Department of Health & Human Services documents showed that a single healthcare record could sell for $250 to $1,000. That’s in comparison to credit card numbers that sell for a whopping $5.
Making matters worse is the ease with which bad actors can break into healthcare systems. HIPAA Journal reported that 98% of survey respondents said inefficient technologies are causing patient care and safety issues, with 23% reporting they often resort to workarounds to get the job done. All of which present significant compliance and safety issues. With many hospitals still running on legacy systems, it takes an average of 279 days to detect and contain a breach. That’s over five weeks longer than the global average.
These older systems aren’t just slowing organizations down and opening them to threats; they’re also extremely expensive to maintain. Gartner reports that maintaining legacy systems consumes up to 75% of IT budgets. The result is that many healthcare organizations are left feeling trapped. They can’t afford the system downtime needed to switch systems, nor can they afford a massive technology overhaul. Yet, they also can’t afford to keep running expensive legacy systems that don’t keep up with demands for both patient care and security.
Defence postures are often more sophisticated in the financial services industry, but once a bad actor gets a foothold in the organization, the data is immediately monetizable. Hackers aren’t stealing and selling data or holding it for ransom. The financial records, account credentials, and transaction data can be instantly used to unlock large sums of money. The financial services industry is enticing because there’s a high volume of transactions happening every day that, if intercepted by a bad actor, could result in a big payout — and big ramifications for organizations. IBM reports that financial services attacks are the second most expensive, costing $5.56 million on average.
Financial institutions also often have complex systems designed to accommodate customer demand for fast transactions. These systems are difficult to maintain and often have gaps that leave organizations open to attack. According to one 2025 report, financial services organizations have nearly 450,000 exposed sensitive files, 36,004 of which are open to everyone in the organization. This is the highest number of any industry.
The attack surface in the financial services industry is also expanding at a rate many security teams can’t keep up with. Between mobile banking applications, digital payment systems, open banking integrations, and budgeting software, there are endless ways for bad actors to break in.
Financial services organizations may also be more likely to pay a ransom on double extortion ransomware attacks. The banking and fintech industries are highly regulated. So the cost of a cyberattack includes not only remediation and lost business but also major fines and penalties.
For all these reasons, financial services adversaries are numerous and persistent. There were 737 data compromises in 2024, the highest of any industry that year. Business email compromise, credential theft, and account takeover continue to be successful attack vectors for bad actors. Additionally, the expanding threat landscape and access to high-value data will continue to make this industry a top target in years to come.
The manufacturing industry continues to draw the attention of bad actors. IBM’s X-Force Threat Intelligence Index 2025 reports that 26% of all cyberattack incidents across the top ten industries took place in the manufacturing industry. This is the fourth year in a row that manufacturing has held the top spot. Ransomware was involved in 71% of manufacturing attacks in 2025, which increased 56% from 2024, and accounted for roughly half of all global ransomware incidents. The high volume of ransomware attacks comes down to a few factors.
There is nothing manufacturers fear more than downtime. It’s incredibly expensive, costing thousands of dollars per minute, and it’s visible. When production lines shut down, it’s immediately known and puts pressure on executives to get things up and running as quickly as possible. That makes executives quick to pay ransoms, and hackers know it.
The manufacturing industry is also highly competitive, and trade secrets are held under lock and key, making them very valuable for bad actors. In fact, attacks involving intellectual property are the most costly to businesses.
Perhaps the biggest issue facing the manufacturing industry is the convergence of operational technology (OT) and traditional IT networks. OT devices and industrial control systems are networked, giving bad actors dozens of new entry points that didn’t exist a decade ago. These devices were built to efficiently store and transfer data over the network. But, at the time, security wasn’t a priority, and traditional endpoint security tools won’t work on these devices. Issues remain — more than 1,200 according to the Cybersecurity and Infrastructure Security Agency (CISA) — but fixing software bugs would require shutting down production, which is a nonstarter for most manufacturers.
Making matters worse, management of these devices falls to people working on the production floor — not IT and security teams. The security teams tend to be lean or non-existent because uptime and OT maintenance are prioritized over cybersecurity, so IT teams can’t keep up with the evolving threat landscape.
Though education may seem like a surprising sector for adversaries to strike, the data prove it’s a hotbed of nefarious activity. A new survey found that 77% of K-12 and higher education institutions uncovered a cyber attack on their infrastructure in 2024. That number is up from 69% in 2023.
Between student records, research, and financial aid information, schools and universities hold a surprising amount of valuable data that they are willing to pay to protect. Ransomware groups know this and have begun targeting these institutions more aggressively. In the last 20 years, American educational institutions experienced 3,713 data breaches, which compromised more than 37.6 million records. The Interlock ransomware group alone increased its attacks on U.S. schools from two in 2024 to 17 in 2025.
Educational institutions typically also lack a dedicated cybersecurity function. Budgets are limited, government-controlled; and, in some school districts, there is no dedicated security role. This means there may not be a person who is establishing the strict access controls needed to secure the environment. Also, because education favors an open, collaborative environment, schools are an exceptionally easy target for bad actors.
While each of these industries has unique challenges, they share overarching factors that tie them together. The cybersecurity threats can be broken down into three broad categories, which include:
So what can organizations in healthcare, financial services, manufacturing, and education do to protect themselves from a constant barrage of attacks? Many are choosing to outsource their efforts to Managed Detection and Response (MDR) companies.
MDRs are a more affordable way to gain 24/7 protection that is specific to your needs. As your security partner, an MDR can help you identify security gaps, implement the appropriate software, and work with you to secure your organization and train your staff without significant downtime.
SolCyber helps organizations in the healthcare, financial services, manufacturing, and education sectors build real resilience with our 24/7 detection and response services and Foundational Coverage. Through our human-led outsourced security programs, we provide coordinated protection across people, systems, and operations, giving you visibility into your environments and working to keep your business safe from threats.
Reach out to the experts today to learn how SolCyber can help you become cyber resilient.
Chinese cybercrime suspect takes vacation to Italy. Now faces a much, much longer side-trip to the US.
It’s a breach, but how did it really happen, and what should be done about it?
The US has just announced a Cyber Trust Mark logo for connected consumer devices.
By subscribing you agree to our Privacy Policy and provide consent to receive updates from our company.
