Why cybersecurity is now critical in healthcare sector

Recent attacks have exposed the fragility of Africa’s medical infrastructure. In May 2025, Mediclinic Southern Africa was hit by a cyber extortion attack, compromising sensitive HR data.

Later in 2025, Lancet Laboratories faced a regulatory penalty for failing to notify patients about data breaches under South Africa’s POPIA law, while a ransomware strike on the National Health Laboratory Service disrupted blood test processing nationwide, delaying critical care for millions.

M-Tiba, a Kenyan digital health platform managed by CarePay and backed by Safaricom, suffered a significant cyberattack and data breach in late 2025, while earlier this year Pharmacie.ma, a Moroccan pharmaceutical platform, was reportedly the target of an alleged data leak incident that allegedly involved the unauthorised export of a customer database.

And recent research indicates that Nigeria’s private healthcare sector is now one of the most targeted on the African continent, with attacks increasing at an alarming rate.

Many incidents also go unreported, as hospitals and healthcare facilities rarely disclose them publicly, yet these incidents are not isolated, with ransomware dominating the threat landscape.

Africa’s healthcare sector is heavily targeted by cybercriminals, with healthcare organisations facing an average of 3,575 weekly attacks in 2025, a 38 percent surge from the previous year, with encryption of patient data, temporary loss of access to hospital systems and the risk of data appearing on the dark web cited as potential impacts.

The healthcare industry in Africa, particularly in the public sector, is working with legacy systems, fragmented infrastructure, and underfunded IT teams, all of which combine to make the sector an easy target for unscrupulous bad actors.

Many medical institutions are adopting open-source AI tools for diagnostics and patient management. While cost-effective, these platforms often lack enterprise-grade security, leaving sensitive data exposed. Combined with fragmented storage of paper and electronic patient records – often unencrypted and scattered across multiple systems – the risk of breaches multiplies.

Hospitals and healthcare facilities cannot afford downtime. Every minute offline risks lives, making them more likely to pay ransoms in an attempt to regain control of their systems.

Cyber insurers indicate that in two of five cases of a ransom being paid, data and operations still cannot be recovered. Additionally, in instances where some or all of the seized data is recovered after paying a ransom, the attacker goes on to request further payments.

Medical records are also a premium target for cybercriminals. In the US, researchers found that patient records, insurance details, and research data fetch premium prices on the dark web – up to 10 times higher than financial data, according to cybersecurity analysts.

Medical records frequently include personal identifiers, insurance details, and sometimes biometric data, enabling identity theft and fraud, while criminals use medical data for fake insurance claims, prescription fraud, and targeted scams.

Microsoft believes cybersecurity needs to be embedded into every technology implementation. This should be a key priority, especially with sensitive medical data and operations.

As Africa’s healthcare systems digitise and embrace AI, protecting the digital lifeline must become as critical as protecting the physical one. Key steps can secure healthcare organisations and facilities like laboratories and diagnostic services’ systems.

Medical professionals and healthcare facilities often prioritise the resilience of physical capabilities.

Power backups, multiple devices should equipment fail, and a standby roster in the event of a practitioner being unavailable are all practices that save lives. Equally cybersecurity and safeguarding online systems needs to be built into the overall resilience planning of medical facilities and services.

Investing in cybersecurity technology that can quickly identify and contain attacker activity before it leads to system downtime or data theft can save lives. Having a response plan that is practiced and maintained in the event of a cyber breach and ensuring strong data backups could mean the difference between a total failure of health services or a minor incident.

Ensuring incident response plans are aligned with local compliance laws such as South Africa’s POPIA, and Kenya and Nigeria’s Data Protection Acts is critical for healthcare providers to meet both their resilience and compliance objectives.

Threat actors are increasingly exploiting the interconnectedness of modern software ecosystems and operational structures to conduct malicious activity, so regular auditing of third-party integrations, especially those involving AI or cloud services, is critical.

Microsoft Chief Security Advisor, Africa