SonicWall has released exclusive threat data revealing a hyper-targeted surge in cyber-attacks against the UK healthcare sector. Intrusion Prevention System (IPS) data recorded from January to May 2026 indicates a 10x increase in targeting volume by hackers, thrusting medical institutions and NHS-adjacent networks directly into the crosshairs of global cyber adversaries.
According to SonicWall’s Threat Research team, the UK healthcare sector recorded 264,000 individual IPS events in the first five months of 2026 alone, up from a full-year total of just 27,000 in 2025. This traffic increase represents a per-device attack intensity of approximately 11,000 events per sensor. No other vertical in Britain comes close to this per-device intensity, establishing healthcare as the nation’s most targeted industry.
Key Intelligence:
- Forty-one percent Log4j dominance: 107,708 hits exploit a multi-year-old flaw in unpatched clinical Java middleware.
- Thirty-three percent of monitored sensors saw active attacks on F5 BIG-IP load balancers.
- New web risks: Modern framework flaws (React/Next.js) targeted newly deployed patient portals.
- Silent reconnaissance: Zero ransomware activations mean attackers are quietly mapping networks for future strikes.
The data indicates that this wave of automated, precise exploitation began well before recent geopolitical upheaval, such as the escalations in the Iran conflict and aligns more directly with a global spike in critical infrastructure/OT targeting.
Analysts conclude that attackers are systematically mapping out the complex digital supply chains of the UK’s medical sector, moving through an aggressive, large-scale reconnaissance phase.
“Our data indicated ransomware volumes dropped a sharp 87% in 2025 across UK businesses as ‘Big Game Hunters’ traded volume for precision, going after fewer targets with bigger payloads. Healthcare didn’t get that memo,” said Spencer Starkey, Executive Vice President, EMEA, SonicWall. “Attackers are targeting our hospitals and stress-testing them to breaking points.”
“This is a double-edged crisis,” Starkey said. “Zombie Tech, ancient unpatched systems and legacy Java keeps haunting the NHS because administrators can’t just take a critical care system offline to patch it. Meanwhile, the rush to digitise has opened the door to brand-new web vulnerabilities in patient portals. Threat actors have clocked the gap between old and new and they’re scanning for it relentlessly.”
