R A D I O L O G Y 5 Exploring safeguards and incident response Radiology vs. ransomware: How to defend imaging departments against cyberattacks Cyberattacks on healthcare have reached unprecedented levels, with radiology departments emerging as particularly vulner- able targets. At the Society for Imaging Informatics in Medicine (SIIM) 2026 annual meeting in Pittsburgh, four authors of the new ACR/SIIM cybersecurity guidelines outlined the threats facing imaging enterprises – and the strategies needed to defend against them. Healthcare has become the most targeted sector for cybercriminals. In 2024, at least 289 cybersecurity incidents affected EU healthcare providers – more than any other essential sector, according to the European Commission's Annual Report on NIS Directive Incidents. Ransomware attacks accounted for an estimated 71% of incidents that disrupted patient care, delaying diagnoses and treatments.1 In January 2025, the European Commission developed an Action Plan on the Cybersecurity of Hospitals and Healthcare Providers to strengthen the EU healthcare sector's cyber-resilience.2 The situation in the United States mirrors this trend. The FBI reported that in 2025, healthcare organisa- tions experienced 182 data breach- es and 460 ransomware attacks – the highest number among all critical infrastructure sectors.3 ‘Although no published data exists on successful attacks against hospi- tal radiology departments specifi- cally, they have increased exponen- tially since 2000’, said Po-Hao Chen, MD, security committee chair of the SIIM. That year correlates with the widespread conversion of US hospital radiology departments to all-digital functionality. In response to these growing threats, the American College of Radiology (ACR) and SIIM pub- lished comprehensive guidelines in 2025 for radiology department staff and IT/PACS administrators to protect radiology data and devices against cybersecurity threats.4 Why radiology is particularly vulnerable Radiology departments offer an abundance of opportunities for cyberattacks due to their large attack surface comprising multiple vulnerabilities and transfer risks. ‘Cyberattacks are not just an incon- venience, or just an IT issue, but rather a patient safety and opera- tional issue’, said Reza Forghani, MD, PhD, neuroradiologist, med- ical AI expert, and chief medical information officer for imaging at AdventHealth, a non-profit health- care system with 57 hospital cam- puses in nine US states. Categories of vulnerability include people, processes, physical equip- www.healthcare-in-europe.com ment, software and hardware tech- nologies, the supply chain, and third-party vendors. Locations of data transfer risk span EHR order entry, radiology information systems (RIS), modality imaging acquisition, PACS, archival storage, VNA, work- station use, radiology report prepa- ration, and interactions with other radiology-specific software tools. An additional threat is the use of AI systems. These can impact modality image reconstruction, subsequently add or subtract artefacts, and dis- tract radiologists from accurately diagnosing or making other assess- ments about an imaging exam. ‘AI is offering convenience to radi- ologists, but these conveniences and shortcuts also increase cyber- security risks’, said Dr Forghani. He pointed out that overlooked vulnerabilities include offsite stolen credentials, which – with clever phishing – can open doors. Mobile data sources, such as USB drives and DICOM CD/DVDs, are easy to steal sensitive data from, or can be used to inject malware. Their contents should never be directly inputted into a hospital's system without rigorous safeguard review, he cautioned. Building layered defences Safeguards must be numerous, layered, and always kept current for both internal operations and vendor ecosystems. Physical and technical controls must align per- fectly. Monitoring must be continu- ous and immediately adaptable to new techniques and the mutational nature of cyberattacks. Regularly scheduled training is essential for all hospital staff whose jobs are impacted by a breach. ‘People are the weakest components of cyberattack protection. They can be duped during social interaction or clever phishing, and they may be lax in adhering to the protocols of strict physical security stand- ards’, said Prof. Benoît Desjardins, MD, PhD, professor of radiology, Chief Medical Information Officer and Chief Medical Cybersecurity Officer at the Centre Hospitalier de l'Université de Montréal and the University of Pennsylvania. ‘Key safeguards are physical, technical, and administrative. Similar to legs on a stool, if any one becomes weak, the entire infrastructure becomes unstable.’ Physical safeguards – the first line of defence – require multiple layers of access control: locked doors, key cards, biometric scans, camer- as, disabled USB ports, firewalls, and intrusion detection systems. Modality patches and software updates should be implemented immediately. Outdated worksta- tions, hard drives, and media such as CD/DVDs should be disposed of in accordance with security pro- tocols because they can contain recoverable data. The imperative of continuous governance Technical data protection man- dates continuously updated pol- icies and procedures. Passwords need frequent changes. Access to data needs adjustment with every personnel change. Audit logs, con- taining alerts, need rigorous moni- toring. Regular training of all staff is essential because it reinforces cyber awareness. Training topics should include incident recogni- tion, reporting, password manage- ment, workstation security, and social engineering protection. Prof. Desjardins emphasised that administrative safeguards to man- age access and data throughout their life cycle are imperative. ‘Continuously assess cybersecurity risks, because threats evolve con- stantly. Programs must be designed to evolve with the ever-changing nature of cybersecurity attacks’, he explained. ‘Without continuous gov- ernance, technical controls become ineffective. A useful mindset is to presume an attack is already under- way and to prepare accordingly.’ Resources need to be prioritised. Security policies for clearly estab- lished regular risk assessments and protocol evaluations need to identify vulnerable systems, net- works, and data storage networks. Leadership policies are needed for access control, data encryption, and device management. Protocols are also needed for access, retention, and disposal of radiology records to ensure compliance. All vendors and third-party con- tractors must be held to the same standards and policies. Vendor eco- systems increase operational risk exposure. ‘Require a cybersecurity bill of materials for cyber devic- es. Always incorporate in contracts breach notification and rights to access vendor logs upon request, no matter how frequently’, recom- mended Prof. Desjardins. When disaster strikes: incident response and recovery In spite of best efforts, what hap- pens if a hospital gets attacked and the radiology network becomes inoperable for weeks? Prof. James T. Whitfill, MD, Senior Vice President and Chief Transformation Officer at HonorHealth, a non-profit Arizona- based health system with nine hos- pitals, described just how unin- formed hospital clinicians and staff who rely on radiology department services may be. ‘Ask hospital peers how they would respond to a cyberterror event. The most common response may be: “We'll wait for the network to come back up. The IT department will fix it”’, Prof. Whitfill comment- ed. ‘Well, eventually. What people don't realise is that an outage due to a ransomware attack can take an entire network down, even unaf- fected parts that are shut down for protection.’ From his experience, a major cyberattack may take at least a week for the forensics alone to be done, assessing the extent of the damage done, and what it will take to cleanly restore. Radiologists can interpret imag- es directly from the modality, but most modalities go into autopurge mode when their storage is full, the expert continued. To avoid data loss, scanners should therefore be equipped with additional exter- nal storage options, he advised. It should also be clear how reports and images are kept in sync when trying to restore them. How to get prepared for the worst-case scenario Prof. Whitfill explained that a hos- pital incident command will have the goal of maintaining operations and prioritising needs. Technology response teams will start by assess- ing the extent of the attack. They go to backup copies and work backwards to try to identify where and when the attack began – to find a safe space to start the restoration. It is imperative to evaluate the viability of backups. Restoration plans for different sce- narios, such as bare metal restore and file restoration, are needed because it may be necessary to replace contaminated hardware as well as reinstall software. The expert provided his audience with a comprehensive list on how to prepare: ‘Bring every potentially impacted leadership team into the same room to hear the consequenc- es that radiology network down- time would cause. Get feedback. Develop and play simulation exer- cises. Compare simulated downtime events for discrepancies with down- time plans. Make corrections.’ 'Recovery may be very piecemeal. System restoration versus system recovery are different. Predefine which clinical systems are restored first. Improvised work introduces errors which need to be identified. Reports and images have to be rec- onciled, and critical findings may have to be added manually. All this needs to be planned for. Educate, educate, educate. Practice simu- lations regularly and repeatedly', Prof. Whitfill concluded. Report by Cynthia E. Keen References: 1. Annual report NIS Directive incidents 2024. CG Publication. August 2025. https://ec.europa.eu 2. Goodger S, Kuiper E. From ransomware to statecraft: Protecting EU healthcare in the new threat landscape. Policy Brief. European Policy Centre. 21 November 2025 3. Federal Bureau of Investigation. Internet Crime Com- plaint Center. Internet Crime Report 2025. 4. Chen P-H, Desjardins B, Strassner B, Forghani R, et al. Protecting Radiology Data and Devices Against Cyber Security Threats: a Joint White Paper of the ACR and Society for Imaging Informatics and Medicine. J Am Coll Radiol 2025;22:1160-1172. (Open Access) l l i f t i h W . f o r P © James T. Whitfill, MD James T. Whitfill, MD, is Professor of Medicine at the John Shufeldt School of Medicine and Medical Engineering of Arizona State University in Phoenix, USA. He is also Senior Vice President and Chief Transformation Officer at HonorHealth, a non-profit Arizona- based health system. i n a h g r o F r D © Reza Forghani, MD, PhD Information Officer Reza Forghani, MD, PhD, is Chief Medical for Imaging at AdventHealth, a large US non-profit healthcare system with 57 hospital campuses in nine states. A neuroradiologist and medical AI expert, he also serves as Chief of Imaging Informatics at AdventHealth Medical Group Central Florida Division. n e h C r D © Po-Hao Chen, MD at the Po-Hao Chen, MD, is Vice Chair of Artificial Intelligence and Medical Director for Enterprise Radiology Informatics Enterprise Diagnostics Institute of Cleveland Clinic in Ohio, USA. He chairs SIIM's security subcommittee and is the lead author of the ACR/SIIM white paper on protecting radiology data and devices against cybersecurity threats. Benoît Desjardins, MD, PhD, is Professor of Radiology at the Centre Hospitalier de l'Université de Montréal (CHUM) in Quebec, Canada, and Professor of Radiology and Medicine at the University of Pennsylvania, USA.