LockBit Ransomware Attacks on Hospitals — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Jul 20, 2026

Severity: Critical | View Full Scam Details

LockBit Ransomware Attacks on Hospitals in India 2026: A Deadly Cyber Threat

LockBit ransomware attacks on hospitals pose a critical threat to India’s healthcare sector, risking patient safety and data security.

What Is the LockBit Ransomware Attacks on Hospitals?

LockBit ransomware is a type of malware that cybercriminals allegedly use to lock down computer systems by encrypting vital data, demanding ransom payments to restore access. In 2026, hospitals and healthcare institutions in India have increasingly become targets of these attacks, putting sensitive medical records and hospital operations at severe risk.

Hospitals like AIIMS Delhi have reportedly faced incidents where LockBit ransomware disrupted crucial services. Attackers usually exploit vulnerabilities in hospital IT infrastructure, such as unsecured Wi-Fi networks or gaps in hospital staff's cybersecurity awareness. Given the sensitive nature of patient data and hospital dependency on digital systems, these ransomware incidents are particularly dangerous.

According to advisories from India’s Computer Emergency Response Team (CERT-In), healthcare entities are prime targets due to the criticality of their services. The Indian Cyber Crime Coordination Centre (I4C) has also highlighted that ransomware attacks on medical services can have life-threatening consequences if operations are stalled. The Reserve Bank of India (RBI) has issued guidance to financial institutions on monitoring suspicious UPI transactions possibly linked to ransom payments, emphasizing the connection of these scams with digital payments and online communication platforms like WhatsApp.

How This Scam Works — Step by Step

1. Reconnaissance: Scammers scan hospital networks using dark web intelligence and phishing techniques to identify security weaknesses.
2. Phishing Email or Malicious Attachment: Hospital staff receive seemingly legitimate emails or WhatsApp messages from trusted sources, containing malicious links or attachments.
3. Infection of Hospital Systems: Once an employee clicks on the link or opens the attachment, ransomware like LockBit executes, encrypting medical records and vital system files.
4. System Lockdown and Ransom Demand: The ransomware locks hospital systems and displays ransom notes demanding payment in cryptocurrencies or through digital payment apps such as UPI.
5. Communication Through WhatsApp or Email: Scammers often use WhatsApp to communicate and negotiate ransom. They may threaten permanent data loss or public release of sensitive patient information.
6. Impact on Hospital Operations: Hospitals struggle to access patient files, appointments, and treatments, risking patient lives.
7. Payment and Recovery (If Paid): Victims may make UPI payments to addresses provided by attackers, hoping to get decryption keys, though success is not guaranteed.

Real Warning Signs to Watch For

• Unexpected emails or WhatsApp messages with urgent requests related to hospital or medical IT issues.
• Attachments or links claiming to be from hospital administrators or government health officials but coming from unfamiliar or suspicious contacts.
• Sudden slowdown or freezing of hospital computer systems, followed by ransom pop-up messages.
• Requests for ransom payments in cryptocurrency or UPI IDs from unknown sources.
• Unauthorized login alerts or unknown devices connecting to hospital Wi-Fi networks.
• Public announcements or news reports about unusual downtime in hospital digital services.
• SMS or WhatsApp messages asking hospital staff for KYC details or login credentials for IT systems.

What Happens to Victims

Hospitals hit by LockBit ransomware face massive financial losses due to ransom payments and recovery costs. There is also the risk of sensitive patient data being leaked, violating privacy laws under India’s IT Rules 2021 and impending Data Protection laws. Patients may experience delays or cancellations of critical treatments, potentially leading to life-threatening situations. Victims usually cannot reverse UPI payments made as ransom since RBI allows very limited transaction reversals in such fraud cases. Additionally, compromised Aadhaar details or SIM swap incidents may intensify the breach, allowing scammers to trick hospital staff further or access financial systems.

What RBI and CERT-In Say

CERT-In advises all healthcare organizations to regularly update security patches, conduct cybersecurity awareness programmes, and have incident response plans tailored to ransomware threats. The RBI emphasizes careful monitoring of electronic payments, including UPI transactions, and urges banks to flag suspicious activities promptly. The government’s 1930 cybercrime helpline provides assistance for victims of ransomware and digital fraud. I4C also encourages close cooperation between hospitals and local cybercrime units to report and mitigate such attacks.

How to Protect Yourself

1. Educate hospital staff regularly about phishing attacks and suspicious WhatsApp messages.
2. Use strong, unique passwords for all hospital IT systems and enable multi-factor authentication.
3. Secure hospital Wi-Fi networks with strong encryption and restrict access to authorized personnel only.
4. Keep software, operating systems, and antivirus up to date with the latest security patches.
5. Avoid clicking on links or downloading attachments from unknown or unverified sources.
6. Back up all critical patient data on offline or cloud storage that is not connected to hospital networks.
7. Verify any unexpected payment or KYC requests through official hospital channels before acting.

What to Do If You’ve Been Targeted

1. Immediately disconnect infected devices from the hospital network to prevent spread.
2. Inform the hospital’s IT security team and senior management.
3. Report the incident at cybercrime.gov.in and call the 1930 national cybercrime helpline.
4. Contact your bank and the RBI helpline to monitor and possibly freeze UPI or bank accounts involved.
5. Preserve all evidence like ransom notes, emails, WhatsApp messages, and transaction records.
6. Consider consulting cybersecurity experts for secure data recovery options.
7. Report Aadhaar misuse or SIM swap suspicions to UIDAI and mobile service providers.

Frequently Asked Questions

Q: How do ransomware attackers use WhatsApp in these hospital scams?
A: Attackers often send malicious links or malware through WhatsApp messages posing as trusted hospital officials or government bodies to trick staff into installing ransomware or sharing sensitive data.

Q: Can paying the ransom recover hospital data safely?
A: Paying ransom does not guarantee data restoration. It also encourages attackers. Hospitals should first seek expert help and report to cybercrime authorities before considering any payment.

Q: How does RBI monitor UPI payments linked to ransomware ransom?
A: RBI works with banks and payment platforms to identify suspicious UPI transactions flagged by unusual amounts, frequency, or recipients, and issues warnings and preventive guidance.

Verify suspicious messages and payment requests with BharatSecure.app and report cyber fraud promptly at 1930 to help protect yourself and others.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.