Project Meridian’s analysis of ~40,000 hospitals finds the most urgent risks form a short, fixable list. Rural clinics and shared suppliers face outsized exposure.
NEW YORK–(BUSINESS WIRE)–SecurityScorecard today released “Visiting Hours: What Hackers See When They ‘Drop By’ America’s Hospitals and Clinics,” an outside-in snapshot of U.S. healthcare cyber risk. The report draws on Project Meridian, SecurityScorecard’s geospatial intelligence platform that shows cyber and physical risk across the nation’s 16 critical infrastructure sectors as one connected system. The report uses Project Meridian to show what hackers see when they probe America’s hospitals and clinics, and it gives leaders a 30-day plan to act on what they find.
Attackers scan hospitals’ internet-facing systems for outdated software, weak logins, and leaked passwords, then take the path of least resistance, whether that means a direct strike or a break-in through a supplier. In the past 18 months, cyberattacks have hit hospitals and health systems in states including Texas, Missouri, South Carolina, Massachusetts, Mississippi, and Ohio.
Hospitals depend on suppliers and computers for patient records, imaging machines, phone systems, and even building controls. When hackers manipulate those systems, ambulances divert, surgeries are delayed, and staff go back to paper. In a city, patients can go to another hospital a few blocks away. In a rural county, the next hospital may sit 30 miles away, leaving patient care delayed or canceled.
Project Meridian addresses the gap by showing cyber and physical risk across the nation’s 16 critical infrastructure sectors (designated by the Cybersecurity and Infrastructure Security Agency (CISA)) as one connected system. Using only what any malicious attacker on the internet can see, it shows the cyber risk at each facility, the cascading effects that can follow one breach, and the geographic dependencies around it.
With Project Meridian, leaders can see a hospital, its cyber posture, and the energy, telecommunications, water, and vendor dependencies around it on one map. That visibility matters. Artificial Intelligence (AI) has made these gaps more urgent by shrinking the window defenders have to find and fix what is exposed. Nation-state actors have also sought to pre-position inside critical infrastructure, targeting the dependencies that let them probe, break in, or pressure decision-makers, according to public reports.
The healthcare report’s blast-radius map shows how a breach at one facility can affect other facilities and critical infrastructure in the same area. This is the lived reality for patient care during a breach or ransomware attack. The report recommends that healthcare leaders prioritize the gaps that put care at risk and close them before an incident forces the issue.
Key findings from the report:
- Known vulnerabilities are common: About 1 in 7 healthcare records (5,862) carries a Known Exploited Vulnerability (KEV) flag, meaning CISA reports attackers already use the flaw in real attacks.
- Most graded facilities score well: Of 7,818 graded records, 62.5% earn an A or B, but 1 in 6 earns a D or F.
- A top score does not mean zero risk: One Texas health system earned an A while running eight urgent vulnerabilities on live machines, the most of any group studied.
- Shared suppliers spread risk: Among 12 Texas hospital groups, 11 rely on the same vendor, and 72 of 313 suppliers appear at two or more groups, so one vendor failure can reach many sites.
- Rural clinics have less margin for error: They earn a D or F more often than hospitals, and the next facility can sit far away when systems fail.
- Leaked credentials are widespread: Leaked-credential signals appear on 3,767 records (9.6%), and 10 records show signs consistent with possible compromise.
The report also finds that some of the most urgent problems are manageable. In the report’s Texas case study, 316 possible vulnerabilities narrowed to nine that are confirmed on live systems and listed in the CISA KEV catalog. Five sit on the hospitals’ own machines. Three of those five have been used in ransomware attacks, according to CISA.
Two Risks That Put Patient Care on the Line
When the Backup Is Miles Away
When a rural clinic goes down, the next facility can sit miles away. A technology disruption in a rural community can quickly become a gap in patient care.
The report finds that rural clinics earn a D or F more often than hospitals (16.7% vs. 15.2%). The grades measure cyber posture, but the geographic reality of distance raises the cost of any incident.
When One Supplier Has a Bad Day
Many hospitals rely on the same suppliers. In the Texas sample, 72 of 313 vendors appeared at two or more hospital groups. Eleven of 12 groups use Microsoft. The 2024 Change Healthcare attack, which disrupted pharmacies and hospital billing across the country for weeks, showed the consequences of concentrated risk like this. Many affected providers were disrupted through their connection to a shared supplier, according to public reports.
From Exposure to Action: A Shared Roadmap for Protecting Patient Care
Hospitals and lawmakers need to know where to act first, and communities need care that stays open. Each group asks a version of the same question: what do attackers see when they look at us? A lawmaker needs independent evidence of where risk concentrates before funding a program or setting a standard. A hospital administrator needs a ranked list of fixes to assign to a team, along with the systems and vendors the hospital depends on. Chief Information Security Officers (CISO) need to know which exposures attackers will reach first. In a rural county, where the next hospital may sit 30 miles away, a family needs the local hospital to stay open when its systems come under attack.
Project Meridian gives all of them the same connected view of the risk and a path forward.
“A hospital’s front door has a lock. The front door to its internet-connected systems stays open around the clock, and attackers test it constantly,” said Dr. Aleksandr Yampolskiy, CEO and Co-Founder of SecurityScorecard. “Most leaders still cannot see what attackers see. Project Meridian is the connected map that every leader, every hospital owner and administrator, every rural clinic, and every security team needs to buy down risk. It shows each facility, its exposures, the vendors it shares, and the services around it that it depends on. That map becomes your roadmap. Start with the short list of urgent problems. Patient care across the country depends on leaders closing these gaps, and Project Meridian by SecurityScorecard illuminates many of them today.”
“A strong grade does not guarantee a clean system. One Texas health system earned an A and still had eight urgent vulnerabilities present on live systems,” said Michael Centrella, Head of Public Policy at SecurityScorecard and former Assistant Director of the U.S. Secret Service. “Hospitals are critical infrastructure, and a cyberattack on one can quickly become a public safety event. In a rural county, the next hospital may be 30 miles away. Policymakers need independent, outside-in visibility into where cyber risk is concentrated because self-reported assessments alone cannot show everything an attacker can see. Lawmakers should fund cybersecurity improvements for rural clinics and small hospitals, hold critical technology suppliers to a higher security standard, and establish multi-factor authentication as a minimum requirement for remote access, email, and patient portals. After 25 years in federal law enforcement and national security, I learned that identifying and reducing risk before an incident is almost always less costly than responding after the damage is done.”
“Attackers work from the same internet-facing telemetry we do, and many of the risks hospitals and clinics face are knowable if you look in the right place,” said Richard Hummel, Vice President of Threat Intelligence & Research at SecurityScorecard. “Project Meridian points that telemetry at defense. It maps exposures, shared vendors, and the infrastructure around them, so defenders can prioritize the flaws attackers are most likely to target. Threat intelligence matters most when it can help a hospital act before an incident, and this view helps leaders meaningfully reduce risk for the patients who depend on them.”
“AI is compressing the time between disclosure and exploitation, and defenders can’t wait for an attack to show them where they’re exposed. Nowhere is that more true than in healthcare. Hospitals run on outdated servers alongside infusion pumps, imaging systems, and building controls that were built to last for decades and were never built to be secured,” said Dr. Mike Mylrea, CISO and Chief AI Officer at SecurityScorecard. “You can’t patch them without disrupting care, and one exposed device or supplier can knock out hospitals across a region. When that happens, attacks can lead to loss of life. SecurityScorecard’s Project Meridian enumerates those supply chain vulnerabilities so defenders can fix them before attackers find them.”
What Healthcare Leaders Can Do in 30 Days
The report includes a 30-day plan for state health departments, hospital groups, and rural clinic networks. In week one, teams should list every record with a KEV flag or a high likelihood of exploitation, sort by care setting, and assign an owner to each item. Then they should confirm each vulnerability, patch or disable the affected service, reset leaked passwords, and turn on multi-factor authentication. By week four, they should run a downtime drill, document where patients go if a clinic closes, and list shared suppliers with emergency contacts.
Recommendations for Lawmakers
The report urges lawmakers to direct funding to rural clinics and small hospitals, treat major healthcare suppliers as critical infrastructure, require multi-factor authentication as a baseline, measure risk from the outside rather than relying on surveys alone, and fund rural downtime planning.
Availability
The full report, including methodology, is available today. This report uses outside-in observations of U.S. healthcare organizations. It draws on Project Meridian’s national inventory of 39,319 healthcare records, as of October 23, 2026.
Each record is a mapped site, not a unique health system or patient, and counts are records, not organizations or people. They invite verification and do not establish a breach, a live dependency, or patient harm.
The report covers every facility record that Project Meridian holds, examining the vulnerabilities and exposed services on each facility’s internet-facing systems. To protect privacy, the report does not identify healthcare entities by name.
To see what attackers see in your county, state, or district, read the full report.
About SecurityScorecard
SecurityScorecard is the global leader in threat-informed third-party risk management (TPRM), securing the world’s supply chains. The company delivers a threat-informed approach to TPRM that enables organizations to drive out risk at the source. The platform uses continuous visibility and AI-accelerated workflows to help organizations reduce third-party risk before incidents occur and respond with confidence when they do.
Trusted by 3,000 organizations, including over 70% of the Fortune 100, and recognized as a trusted resource by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Backed by Evolution Equity Partners, Silver Lake Partners, Sequoia Capital, Google Ventures, and Riverwood Capital, SecurityScorecard delivers end-to-end supply chain cybersecurity that safeguards business continuity.
Protect the supply chain behind your business. Learn more at securityscorecard.com.
Contacts
Media contact:
10Fold for SecurityScorecard
[email protected]
