Moody’s Ratings found that 59% of the healthcare organizations it rates that suffered a cyber incident since 2020 were reached through a third-party vendor, compared with 40% across all sectors.
Healthcare is the only sector where the third-party share has stayed above the cross-sector average every year, according to an Oct. 21 Moody’s report shared with Becker’s. The rate climbed from 38% in 2020 to 53% in 2024.
Moody’s tied the trend to hospitals’ reliance on EHR vendors, laboratory networks and insurance claims clearinghouses. No single vendor drives it: Even in healthcare’s worst year, the February 2024 ransomware attack on UnitedHealth Group’s Change Healthcare accounted for fewer than a third of the rated healthcare organizations hit through a vendor that year.
Insurance and education posted similar rates, at 59% and 57%, respectively. Moody’s attributed those to one-off spikes tied to breaches at widely shared platforms, such as the 2023 MOVEit file-transfer campaign.
Moody’s said the credit risk is sharpest for nonprofit hospitals and higher education, two heavily exposed sectors with less financial room to absorb a disruption. For hospitals, cash flow has moderated since the pandemic amid higher labor and supply costs. Nonprofit hospitals also lag on vendor oversight. Only 43% of those surveyed review vendors’ cybersecurity practices at least annually, compared with 65% across Moody’s 2025 survey of nearly 2,000 rated organizations.
Across all sectors, 39% of rated organizations with a cyber incident in 2025 were reached through a third party, up from 19% in 2020. Moody’s expects that exposure to keep rising as AI tools lower the barrier to discovering and exploiting software vulnerabilities across shared vendor networks.
The report drew on data from Moody’s affiliate Bitsight, covering about 8,000 rated organizations and more than 4,200 cyber incidents since 2020.
A separate Oct. 20 Moody’s analysis ranking cyber risk across 21 U.S. sectors placed healthcare among six sectors with very high exposure but defenses strong enough to offset it. Pharmaceuticals, insurance and healthcare drew nearly a quarter of cyberattacks over the past two years, Moody’s said, and healthcare’s central role in the economy makes it an attractive target for the most capable nation-state actors.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
