Ransomware is increasingly about stopping a business from functioning, not just stealing or encrypting files. The sectors feeling this most acutely are healthcare, manufacturing, managed service providers, and critical services where every minute of downtime carries a real human or economic cost.​

When “just” data loss isn’t the point

In today’s big-game ransomware operations, the goal is often to paralyze hospitals, factories, and essential services long enough that paying a ransom looks (or is) cheaper than staying offline. Research on healthcare incidents shows that even short-lived disruptions to electronic health records, labs, imaging, and communications can force hospitals to divert ambulances, cancel surgeries, and work on paper, with measurable impacts on patient outcomes.​

A University of Minnesota and Medicare data analysis found in-hospital mortality rose by about 33% during ransomware incidents at affected hospitals, translating to an estimated 42–67 additional deaths over five years — not because data was stolen, but because systems needed for timely care were unavailable.​

From file lockers to business shutdowns

Early ransomware campaigns behaved like crude file lockers: encrypt documents on individual endpoints and demand a payment for a decryption key. Over the last several years, operators have shifted to double and triple extortion, combining encryption with data theft and public leak threats, and more recently emphasizing operational leverage — hitting hypervisors, backup infrastructure, and critical applications that keep the business running.​

Analysts now describe ransomware as a “systemic threat to national resilience,” pointing out that a growing share of attacks strike sectors whose disruption has cascading effects, including manufacturing, healthcare, energy, transport, and finance. In manufacturing alone, one study estimated ransomware-induced downtime has cost about 17 billion dollars since 2018, with average downtime of 11.6 days and roughly 1.9 million dollars in losses per day, underscoring that the real leverage for attackers is operational paralysis.​

Why uptime is the new crown jewel

For many modern organizations, especially in healthcare and industrial settings, the most mission-critical asset is not a particular database but the ability to keep core services operating safely and on time. Downtime from ransomware in ICS/OT environments has been estimated at roughly 4.73 million dollars per incident on average, and operators often face additional safety risks, regulatory penalties, and long, complex recovery windows because OT systems are harder to restore than typical IT workloads.​

Ransomware groups understand these pressures. Threat intelligence reporting notes that roughly half of recent global ransomware incidents have targeted critical sectors like manufacturing, healthcare, and energy, where even short shutdowns can ripple through supply chains or public services. That is the essence of the new calculus: your real crown jewels might be uptime and continuity, not just confidential data — and attackers are pricing their demands accordingly.​

Sector snapshots: healthcare, manufacturing, critical services

• Healthcare:

  • More than 250 healthcare organizations were hit by ransomware in 2024, and attacks have continued to climb, with hundreds of incidents and millions of records exposed in 2025.​

  • Studies and case analyses show that attacks can halt EHR systems, labs, imaging, pharmacy, and billing, leading to diverted emergency cases, delayed cancer treatments, and higher mortality rates, with effects spilling over to neighboring hospitals that must absorb additional patients.​

• Manufacturing and OT/ICS:

  • Ransomware incidents against manufacturers surged sharply, with one 2025 report citing a 61% year-over-year increase and high-profile cases at major automotive and industrial firms that triggered global production shutdowns.​

  • Analysis of dozens of cases estimates downtime losses in the sector at billions of dollars, emphasizing that taking production lines and control systems offline is often more damaging than data exfiltration alone.​

• Other critical services:

  • Critical infrastructure and financial services are increasingly targeted because disruption of power, transport, or payment systems generates immediate public and economic pressure to resolve incidents quickly, sometimes by paying.​

Tactics that target operations, not just data

To maximize operational disruption, modern ransomware crews increasingly:

• Hit virtualization and core platforms

  • Target hypervisors and virtualization platforms to encrypt many workloads at once, taking down clusters of servers and applications instead of individual endpoints.​

• Destroy or encrypt backups

  • Systematically locate, encrypt, or delete backups and shadow copies so that organizations cannot easily restore services, forcing longer outages and harsher ransom negotiations.​

• Go after identity and OT gateways

  • Compromise domain controllers, privileged access systems, and IT–OT gateways to lock out operators or gain control over industrial processes, making it difficult to regain safe operational control even after initial containment.​

These tactics reflect a shift from “Can we get them to pay for their data?” to “Can we put them in a position where paying is the fastest path to get back online?”

Rethinking what counts as “crown jewels”

Many organizations still define crown jewels primarily as sensitive data repositories — customer PII, financial records, intellectual property. That lens misses critical chokepoints like hospital scheduling systems, ICS controllers, enterprise resource planning platforms, and logistics hubs whose outage instantly disrupts service delivery.​

Recent sector reports emphasize that resiliency planning must start from essential services and processes: identify which clinical workflows, production lines, or infrastructure services cannot tolerate more than a small amount of downtime, then map the specific applications, infrastructure, identities, and third parties those processes depend on. For many organizations, that exercise reveals that “uptime of X system” is the true crown jewel, and the associated data is secondary in the short term.​

Designing for operational resilience against ransomware

Defending against this evolved ransomware model means treating operational continuity as a first-class security objective:

• Architect for recoverability, not just prevention

  • Maintain tested, isolated backups that can restore not only data but full platforms and configurations for critical systems, including EHRs and ICS/OT environments.​

  • Regularly rehearse ransomware-specific recovery scenarios to validate realistic recovery time objectives (RTOs) for key services, not just generic DR plans.​

• Segment and contain blast radius

  • Enforce strong segmentation between IT and OT networks, and between critical and non-critical environments, so that an intrusion in one area does not automatically lead to enterprise-wide shutdown.​

  • Harden and monitor identity infrastructure and remote access paths, as many OT ransomware intrusions still originate from compromised IT accounts and weak integration boundaries.​

• Align business continuity with cyber reality

  • Update business continuity and disaster recovery plans to assume scenarios where systems are unavailable or untrusted, and define safe manual fallback procedures where possible, particularly in healthcare.​

  • Include ransomware disruption in tabletop exercises with both technical teams and operational leadership.​

Ransom calculus: when downtime sets the price

Incident reviews suggest that as downtime costs shift into millions per day and attacks increasingly target critical services, the economic pressure to pay ransoms intensifies, despite law-enforcement and policy guidance against payment. Because restoring industrial systems often requires physical intervention and specialized work, organizations may see paying as the only way to shorten outages, which in turn encourages attackers to keep aiming at operational chokepoints.​

In other words, if you cannot restore operations quickly and confidently on your own terms, attackers effectively get to set a price on your uptime — and they know exactly how painful each hour offline can be for your sector.​

From data-centric to uptime-centric security

The work of defending against ransomware is no longer just about keeping data confidential; it is about ensuring that critical services can withstand and recover from targeted disruption. The most important question is less “What if they leak our files?” and more “What happens if they turn off the systems that let us do our jobs?”​

A practical next step is to revisit your crown-jewel inventory and ask:

• Which services or processes can we not afford to have offline for more than a few hours or a day?

• For each of those, do we have a realistic, tested plan to restore safe operation if ransomware takes the primary systems down?

If the answers are uncertain, your most valuable asset is already clear: uptime. And ransomware crews are betting that you have not fully protected it yet.

Additional Sources:

https://www.vikingcloud.com/blog/ransomware-statistics

https://runsafesecurity.com/blog/how-protect-yourself-ransomware-attack/

https://www.hipaajournal.com/hospital-ransomware-attacks-have-impact-on-neighboring-hospitals/