Hospitals Brace for AI-Driven Attacks That Can Outrun Traditional Recovery Plans
Healthcare systems built around constant connectivity are confronting a new operational threat: attacks that move faster than human response and linger longer than standard disaster-recovery playbooks allow. At Rubrik’s Healthcare Summit, cybersecurity leaders described a risk environment in which a single exploit can cascade through scheduling, imaging, pharmacy workflows, supply chains, and bedside care at machine speed.
The warning arrives as policymakers and hospital executives face mounting evidence that healthcare infrastructure can be disrupted far beyond the IT department. Senators recently reintroduced the Health Infrastructure Security and Accountability Act, which would set baseline minimum cybersecurity requirements for healthcare organizations and direct $1.3 billion toward stronger defenses. In August, a cyberattack on Boston Scientific interrupted manufacturing and supply chains, a reminder that modern healthcare depends on a web of digital systems stretching well past the inpatient ward.
The summit’s central message was not simply that cyberattacks are more frequent. It was that AI is changing the tempo and scale of intrusion. Nicole Perlroth, bestselling author and host of the To Catch a Thief podcast, described a threat model in which any vulnerability, configuration error, or human misstep in a security estate can be identified and exploited almost instantly. In practical terms, defenders are no longer contending only with clever criminals; they are facing automated discovery, automated exploitation, and automated persistence.
For hospitals, that changes the clinical stakes. A ransomware event or infrastructure compromise does not stay confined to servers. When scheduling systems fail, elective procedures back up. When medication systems go offline, pharmacy verification slows. When diagnostic platforms lose connectivity, clinicians are forced into manual workarounds that delay decisions and increase the risk of error. John Riggi, national adviser for cybersecurity and risk at the American Hospital Association, called cyberattacks on healthcare organizations a “threat to life,” a phrase that reflects the direct relationship between digital downtime and patient harm.
Riggi emphasized that when technology fails because systems were not designed securely and attackers have already found the weak point, care delivery can stall immediately. That is a sharper warning than the familiar language of data loss or privacy breach. It reframes cybersecurity as an operational safety issue, one that can affect triage, transfers, treatment timing, and access to care across the enterprise.
The threat environment is also geopolitical. The discussion pointed to adversaries in Russia, China, North Korea, and Iran as sources of concern, while noting that AI tools can lower the technical barrier for less sophisticated actors. In other words, the pool of potential attackers widens just as their capacity to launch disruptive campaigns improves. That combination makes healthcare organizations especially vulnerable because they carry high-value data, large installed technology footprints, and operational tolerance that is often too slim for prolonged interruption.
One of the clearest implications from the summit was the need to think beyond conventional disaster recovery. Traditional planning often assumes a bounded outage, a contained restoration sequence, and a rapid return to normal. The speakers urged a very different posture: hospitals should be ready to function without IT support for 30 days or more. That requires more than backup tapes or a recovery binder sitting on a shelf. It demands tested continuity plans, regular downtime drills, redundant systems, and the ability to sustain patient care while digital services remain degraded.
A 30-day outage model forces leaders to ask uncomfortable questions. Which services can continue manually? Which medication, registration, imaging, and transfer workflows fail first? Which departments have trained staff who can operate without networked support, and which depend so heavily on automation that they would stop almost entirely? Those are the questions that separate a theoretical resilience plan from an operational one.
Perlroth’s long-term hope was strikingly concrete: secure-by-design systems, formal methods, timely patching, real-time backups, and backup intelligence. That list matters because it reaches into the architecture of hospital computing rather than treating cybersecurity as a collection of after-the-fact fixes. If systems are built to be resilient from the outset, the window for catastrophic interruption narrows. If they are not, every new AI-enabled adversary gains leverage from the same structural weakness.
The summit also pointed toward a shift in governance. Hospital executives can no longer treat cybersecurity as a back-office technology function isolated from patient safety planning. Board oversight, capital allocation, workflow design, and clinical operations all sit inside the same risk perimeter. A health system that cannot keep systems online—or quickly restore safe function when they fail—faces not only financial exposure but the possibility of delayed or compromised care.
That broader view may be the most important lesson from the discussion. The sector is entering an era in which resilience will be measured less by how quickly data can be restored and more by how long clinicians can safely care for patients when the network is down. The unanswered question is how many hospitals have tested that scenario under real-world conditions, and whether their current continuity plans can survive an outage measured in weeks rather than hours.