Cyber security for Indian healthcare that keeps the clinic open

Threat Surface for Healthcare

Attack shapes every hospital IT lead has to plan against

Ransomware on the HMIS. Attackers know a hospital cannot afford to be offline. When surgeries are scheduled and lab results are queued, the pressure to pay is measured in hours, not days. Every ransomware post-mortem in Indian and US healthcare traces back to the same three gaps: flat network between admin and clinical VLANs, backups without an offline copy, and EDR either missing or excluded from key workstations because someone was worried it would slow down imaging software.

Patient data exfiltration through the portal or app. Login enumeration on the patient portal, IDOR on record IDs in the mobile app, unbounded search on FHIR endpoints. These are the boring bugs that leak a hundred thousand records to a scraper working nights. They are also almost always missed by generic web-app scanners because the abuse pattern is functional, not a payload.

Biomedical device exposure. The infusion pump, the ultrasound machine, the imaging workstation running an OS the vendor stopped supporting six years ago. They cannot be patched without voiding the AMC. They sit on the same VLAN as everything else because nobody made the segmentation call. When an attacker gets to them, they become the persistence layer nothing else has visibility into.

Consent artefact abuse in ABDM flows. If you are a HIP or HIU, consent artefacts are the audit trail regulators will trace when a patient complains their data was pulled without authorisation. Weak certificate rotation, missing signature verification on incoming artefacts, or a gateway that accepts stale timestamps all produce the same outcome: a NHA notice you have to respond to inside a compressed timeline.