In February 2023, pro-Russian hacktivist group KillNet launched distributed denial-of-service attacks against U.S. Hospitals. The attacks were designed to overwhelm networks until patients couldn't access essential services. This wasn't an anomaly — it was a reminder that healthcare cybersecurity has real stakes.
A 2022 Imperva report found that 35.8% of all U.S. Healthcare website traffic came from malicious bots. More than a quarter of those evaded standard detection by mimicking human behavior.
At a glance
- 35.8% of U.S. Healthcare website traffic was malicious bots (Imperva, 2022)
- 27.1% of bad bots used advanced evasion techniques
- Account takeover attacks surged 155% in 2022
- KillNet launched DDoS attacks against U.S. Hospitals in February 2023
- Patient portals often lack two-factor authentication
What bad bots actually do
Three attack patterns dominate:
DDoS attacks**: Botnets flood hospital networks with traffic until EMR systems, scheduling tools, or payment portals become inaccessible. Because traffic is distributed across many sources, security teams often don't detect the attack until services are already down. In healthcare, every minute of downtime compounds consequences — delayed processing, rescheduled procedures, frustrated patients.
Account takeover (ATO)**: Bots automate credential stuffing attacks using username/password combinations from previous breaches. In 2022, ATO attacks jumped 155% from the prior year. Patient portals built without two-factor authentication make this straightforward: one reused password is often enough.
Scraping and form abuse**: Bots harvest provider directories, appointment availability, or pricing data. Less dramatic than an outage, but cumulatively expensive in stolen competitive intelligence and distorted analytics.
Why healthcare is uniquely vulnerable
Healthcare targets differ from retail or finance in ways that matter:
- Patient portals lack standard protections.** Many hospitals treat portal login as a convenience feature rather than a security-critical surface. No two-factor authentication is common.
- Downtime has asymmetric consequences.** A retail site going down costs revenue. A hospital system going down can delay care.
- Legacy systems expand the attack surface.** Hospital environments typically run dozens of applications, many outdated, with inconsistent security controls.
- Data value drives targeting.** Health records enable insurance fraud and identity theft — making them persistently attractive to criminals.
What defenders should actually do
Rob Falbo, VP of Healthcare Solutions at Imperva, recommends:
Risk identification**: Know which surfaces attackers will target first. Authentication endpoints and billing interfaces need the strongest controls. Mobile apps deserve the same bot protection as websites — attackers will use whichever surface has weaker defenses.
Traffic monitoring**: Watch for high bounce rates, failed login spikes, traffic from unknown IPs, and requests to specific URLs. Activity from outdated browsers, proxy servers, or automation frameworks like Selenium or WebDriver is typically malicious.
Incident response**: Have a crisis communication plan before an attack. Backup systems and clear escalation paths matter more than the technical response itself.
Cloud over on-premise**: Cloud-based security adapts to new threats faster. On-premise tools require manual rule updates whenever a new CVE emerges — a burden healthcare organizations often lack resources to meet.
One common miscalculation: placing DDoS protection only at the web layer leaves other vectors exposed. Effective defenses must cover web properties, domain systems, and backend infrastructure to genuinely protect critical assets.
Who should care
| Stakeholder | Primary risk | Immediate action |
|---|---|---|
| Patients | Account takeover, identity theft | Use unique passwords per portal; enable 2FA wherever offered |
| Clinicians | Portal downtime, data exposure | Advocate for 2FA on patient-facing portals; report unusual login activity |
| IT/security teams | Credential stuffing, scraping | Extend bot protection to mobile apps; monitor for automation tool signatures |
| Executives | Regulatory exposure, reputational damage | Require cloud-based security; ensure incident response plans exist |
Our analysis
The most underprotected surface in most hospital systems isn't the EMR or billing system — it's the patient portal. Organizations have invested heavily in hardening their core clinical infrastructure while treating patient-facing web apps as secondary.
Attackers notice this. Until two-factor authentication is standard on every patient portal, ATO attacks will continue their upward trend.
The mobile gap deserves particular attention. Many hospitals have deployed bot management on their main websites but extended weaker controls to their apps. Attackers don't choose their surface based on which one is more "important" — they probe until they find the weakest entry point. The fix is consistency: every patient-facing surface gets identical protections.
For clinicians: pushing for 2FA on patient portals is a concrete way to reduce ATO risk without waiting for organizational security roadmaps. For patients: unique passwords and 2FA aren't optional anymore — they're the minimum.
What to watch next
- HHS updates on healthcare cybersecurity performance goals
- SEC cybersecurity disclosure rules increasing executive accountability
- AI-driven attacks that adapt faster than static defenses can respond
Key takeaways
- More than a third of healthcare web traffic is malicious bots.
- Patient portals are the most under-defended attack surface in most hospitals.
- Two-factor authentication dramatically cuts ATO success rates.
- Mobile apps need the same bot protection as websites.
- Cloud-based security adapts to new threats faster than on-premise tools.
Frequently asked questions
What is a bad bot?
An automated software program designed to attack, abuse, or misuse websites and applications. Categories include DDoS bots, credential stuffing bots, scraping bots, and form abuse bots.
Why are hospitals targeted?
Patient data enables insurance fraud and identity theft, and downtime in healthcare has more severe consequences than in most industries. This combination makes hospitals high-value targets.
What should patients do?
Use unique passwords for every healthcare portal, enable two-factor authentication wherever offered, and review your portal for unrecognized activity.
What should hospitals do?
Implement bot management consistently across every patient-facing surface, require two-factor authentication on patient portals, and maintain an incident response plan before an attack occurs.
Source: electronichealthreporter.com