Hospital cybersecurity leaders should pay closer attention to geopolitical tensions heading into 2027, as international conflicts could directly influence the cyber threats facing U.S. healthcare organizations, according to John Riggi, national adviser for cybersecurity and risk at the American Hospital Association.
“I truly believe that geopolitical risk is the source of the vast majority of the cyber risk we face,” Mr. Riggi told Becker’s.
His warning comes amid what he described as a recent acceleration in cyber threats against U.S. healthcare organizations.
“Just in the past month and a half, we’ve seen a significant acceleration in the number of threats and attacks that we’re seeing against U.S. healthcare,” he said.
Mr. Riggi identified three converging cybersecurity concerns for healthcare in 2027: increasing geopolitical risk, adversaries’ growing use of advanced AI models, and attacks targeting mission-critical third-party technology and service providers.
He pointed to Russia, China, North Korea and Iran as countries associated with cyber threats that could affect hospitals, either through direct attacks or disruptions to the infrastructure and technology providers healthcare organizations depend on.
Russia continues to harbor ransomware groups that attack Western organizations, while North Korea has used remote IT workers to generate revenue for its regime. In October, federal prosecutors charged 14 people in a North Korean remote IT worker scheme that placed operatives at more than 70 U.S. companies, including healthcare employers.
In discussing risks associated with China, Mr. Riggi also pointed to the federal government’s warnings about potentially destructive malware pre-positioned in U.S. critical infrastructure, including telecommunications and energy networks.
He said tensions in the South China Sea could influence the level of cyber risk facing U.S. organizations. Renewed hostilities involving Iran are another concern.
“If hostilities break out with Iran again, we will definitely have an increased cyber risk here in the United States,” he said.
For hospital CIOs and cybersecurity leaders, Mr. Riggi said monitoring international developments is an increasingly important part of understanding their organizations’ exposure.
“That, to me, is the most accurate barometer of the level of cyber risk we will face now and in the future,” he said.
One area he encouraged hospitals to prioritize before the end of 2026 is operational technology, including internet-connected equipment used to support hospital operations.
Mr. Riggi said recent alerts involving Iranian cyber activity targeting operational technology underscore the need for greater cybersecurity oversight of these systems.
He noted that operational technology can be a blind spot for hospitals because facilities management teams may have visibility into equipment that cybersecurity teams lack.
As an example, he described a Nov. 5 AHA advisory about potential vulnerabilities in internet-connected refrigeration and cooling systems, which followed cyber activity involving similar technology in France.
The association encouraged hospitals to identify potentially vulnerable equipment, ensure systems are properly patched and separated from other networks, and consider disconnecting equipment from the internet when feasible.
Adding to the threat landscape is adversaries’ increasing use of advanced AI models, which Mr. Riggi said is contributing to the recent acceleration in attacks against healthcare.
“We are seeing a rapid decrease in the time from vulnerability discovery to vulnerability exploitation,” he said.
Activities that previously took attackers weeks or months, including identifying vulnerabilities and developing malicious code, can now be completed in days or hours using advanced AI models, he said.
Mr. Riggi encouraged hospitals to incorporate AI-powered cybersecurity tools into their defenses to identify vulnerabilities, detect anomalous network behavior and accelerate remediation.
But preparing for 2027 also means looking beyond preventing attacks.
Mr. Riggi said hospitals should develop plans to continue providing safe patient care during extended technology outages, whether those disruptions originate within their own networks, from a critical third-party provider or from a broader loss of internet connectivity.
He encouraged organizations to establish procedures for maintaining care through manual processes or alternative technologies for 30 days or longer.
The AHA has been conducting regional cyber incident response exercises involving federal agencies and state cybersecurity officials in states such as Texas and New Mexico.
Despite the growing threats, Mr. Riggi said hospitals are increasingly recognizing their technological dependencies and working with government partners to strengthen resilience.
“These are the positive developments I see, and this is what gives us hope for 2027,” he said.
