Understanding espionage by healthcare threat actors

Espionage is the practice of secretly gathering confidential information from individuals, organizations, or governments without their knowledge or consent to gain strategic, political, or economic advantage.

According to the 2020 paper Cyber Risk in Health Facilities: A Systematic Literature Review, threats of this nature represent "operational risks to information and technology assets that have consequences affecting the confidentiality, availability, or integrity of information or information systems." Healthcare is a targeted industry, not just for financial gain, but for valuable information.

Why healthcare is an espionage target

Healthcare data allows for identity theft and it also supports intelligence operations. Knowing the health vulnerabilities of a diplomat, a military officer, or a government official provides leverage. Medical research data stolen from pharmaceutical companies or hospital systems can provide insight into state-funded research.

For instance, during the COVID-19 outbreak, a Chinese state-sponsored hacking group known as HAFNIUM was directed by China's Ministry of State Security to infiltrate the computer systems of at least two Houston-area universities as early as February 2020, just weeks before the virus spread across the United States. The hackers specifically wanted the email communications of virologists and immunologists, along with vaccine and medical research data. Their method involved planting malicious code within vulnerable Microsoft servers to harvest usernames, passwords, and research files. Two men, Xu Zewei and Zhang Yu, were indicted in 2023 in connection with the operation, and Xu was arrested in Italy in 2025, according to reporting by the U.S. Department of Justice. The attackers had maintained access to compromised systems for weeks or months before being detected.

This was not an isolated case. In 2019, the MD Anderson Cancer Center dismissed three scientists after the National Institutes of Health raised concerns about their undisclosed ties to China.

According to the Verizon 2026 Data Breach Investigations Report, "State-affiliated actors make up the bulk of the remainder, appearing in close to 15% of breaches... these cases tend to be Espionage-driven." The same report notes that "threat actors are demonstrably using GenAI to help at different stages of attack, including targeting, initial access, and development of malware and other tools."

Ransomware groups like Cl0p, BlackCat/ALPHV, and LockBit have targeted hospitals and healthcare networks, not just to extort money, but because healthcare organizations are pressured to pay. This means attackers combine financial motivation with data exfiltration, and end up selling harvested records to third parties with intelligence interests. The Verizon 2026 Data Breach Investigations Report confirms this by stating that; "System Intrusion remains the top pattern for the Healthcare industry and is largely driven by Ransomware. Threat actors commonly gain access via the Use of stolen credentials or by the Exploitation of vulnerabilities, then deploy Ransomware and frequently follow up with the exfiltration of data for future leverage."

Lastly, the systematic literature review observes that, "hackers can also take advantage of staff loopholes and carelessness to collect data.” The Verizon 2026 Data Breach Investigations Report found that "human element was present in 62% of breaches."

Case study: The Anthem Breach

In 2019, the U.S. Department of Justice charged Chinese national Fujie Wang and members of a China-based hacking group with stealing 78.8 million records from Anthem, one of the United States' largest health insurers.

The stolen data was not limited to medical records. Names, addresses, dates of birth, Social Security numbers, employment information, and income data were all exfiltrated. As U.S. Assistant Attorney General Brian Benczkowski stated at the time, the attackers "violated the privacy of over 78 million people by stealing their personal identifiable information."

What makes the Anthem breach a defining case study is how the hackers used spearphishing to gain initial access, then waited inside Anthem's network for months before moving against the data warehouse. When they finally acted, they transferred large archive files back to China over a month, between October and November 2014. The breach was not discovered and disclosed until February 2015, meaning the attackers had operated undetected for a while. Anthem later paid $115 million to settle related lawsuits.

The healthcare espionage operation

Initial access is often achieved through phishing. Once inside, attackers conduct reconnaissance, identifying high-value targets such as research databases, executive email servers, and patient record systems. After, attackers escalate privileges and go deeper into the system. Finally, exfiltration occurs, often disguised as routine outbound traffic to avoid detection. Anthem's attackers followed this method.

Hospitals still run outdated operating systems, and unpatched medical devices. The Verizon 2026 Data Breach Investigations Report found that "exploitation of vulnerabilities is now the most common initial access vector for breaches. It has risen to 31% in this year's reporting dataset." The remediation process is taking time, "only 26% of critical vulnerabilities... were fully remediated by organizations in 2025, a drop from the previous year's 38%. The median time for full resolution went up to 43 days."

Learn more: Why 83% of healthcare IT teams say legacy systems disrupt operations

Where HIPAA Compliance enters

The HIPAA Security Rule requires that covered entities implement administrative, physical, and technical safeguards to protect electronic protected health information (ePHI). In practice, this should limit the opportunities available to threat actors.

Access controls under HIPAA require that only authorized personnel can access ePHI. This principle of least-privilege access limits how effective a compromised credential is. Audit controls require organizations to maintain logs of who accessed what data and when. These logs are useful for forensic investigation after a breach and serve as a proof.

Transmission security mandates encryption of ePHI in transit. This requirement directly counters network interception attacks and ensures that even captured data cannot be easily read.

Risk analysis requirements require covered entities to conduct regular assessments of potential vulnerabilities. These assessments can show weaknesses that threat actors exploit such as unpatched systems, misconfigured access permissions, gaps in employee training. As the Verizon 2026 Data Breach Investigations Report notes: "DBIRs from 2014 through 2026 have shown that Healthcare has been among the most affected by staff mistakes. Miscellaneous Errors has been among the top three patterns each year." Lastly, breach notification rules require organizations to report breaches to the Department of Health and Human Services and, in bigger cases, to the public.

The limitations of compliance as a defense

Anthem was a major insurer with compliance programs in place. Yet a state-sponsored actor still penetrated its defenses, persisted undetected for months, and exfiltrated millions of records. This shows that HIPAA compliance alone cannot address all threat actors.

This point is reinforced by the systematic literature review, which concludes that defending healthcare systems is "not just a technical issue; it is a richer and more intricate problem to solve", one that requires human behavior, organizational culture, legacy infrastructure, and regulatory gaps. Nation-state APT groups leverage zero-day vulnerabilities, supply chain compromises, and social engineering techniques that make it hard for audit log or access control policies to prevent it. A hospital that is fully HIPAA compliant can still be successfully breached by a well-resourced adversary.

Furthermore, HIPAA's scope is limited to ePHI. Research data, intellectual property related to drug development, and administrative financial records may not fall exactly within its protective mandate, yet these are what espionage actors are after.

FAQs

What is healthcare espionage?

Healthcare espionage refers to the deliberate targeting of medical institutions, insurers, and research facilities by foreign states or criminal actors seeking to steal sensitive data for strategic, financial, or intelligence purposes.

Who is most at risk of healthcare espionage?

While any healthcare organization can be targeted, large insurers, hospital networks, pharmaceutical companies, and medical research institutions.

How does healthcare espionage differ from ordinary cybercrime?

Unlike cybercriminals motivated purely by financial gain, espionage actors are often state-sponsored, and focused on data that holds long-term strategic value rather than immediate monetary reward.

Is patient data the only thing attackers are after?

Besides patient records, attackers target medical research, drug development data, financial records, and executive communications.