The average ransomware demand in healthcare jumped from $577,800 to $16.9 million in a single quarter.
That number reflects a deliberate shift in how ransomware groups operate, and what it means for smaller healthcare organizations including dental practices is worth understanding before an incident, not after.
Patient records consistently sell for more on the black market than credit card data. A stolen credit card gets canceled within hours. A patient record contains a complete identity profile with date of birth, insurance information, medical history, and Social Security number that remains exploitable for years. When healthcare systems go down, the pressure to restore operations is immediate and concrete. A hospital cannot delay surgeries. A dental practice cannot access patient charts, imaging systems, or scheduling. Attackers understand this, and they price accordingly.
Ransomware groups are no longer guessing what an organization will pay. Before deploying ransomware, sophisticated groups spend weeks or months inside a target network, mapping systems, assessing revenue, identifying insurance coverage, and evaluating operational dependencies. The demand gets set at whatever the attacker calculates will be paid faster than the cost of recovery. If your cyber insurance policy covers up to $20 million and your operational cost of downtime runs $500,000 per day, a $16.9 million demand starts to look like a rational offer from the attacker's perspective.
The jump in average demand reflects attackers getting better at valuing targets, and organizations giving them more time to do the research.
The organizations that end up paying are rarely the ones with the weakest security perimeter. They are most often the ones without a tested recovery plan. When ransomware encrypts primary systems and reaches the backup destination simultaneously, there is nothing to restore from. When systems go down at 2am and nobody has rehearsed the scenario, decisions get made under pressure by people who have never thought through who makes the call, who contacts the insurer, who notifies patients, or in what order any of it happens. Organizations that have tested their recovery process know their numbers. Organizations that have not are negotiating blind.
For dental practices, the risk profile carries an additional layer. Practice management software, digital imaging systems, and patient records all contain PHI. A ransomware incident that encrypts that data is presumed to be a reportable breach under HIPAA unless the organization can demonstrate the data was never accessed, a difficult standard to meet when attackers have been inside the network for weeks.
Vert Noir Corp works with dental practices in the Seattle area to assess backup posture and document incident response procedures before an incident forces those decisions under pressure. The assessment identifies exactly where the gaps are and what it would take to close them.
A $16.9 million demand reflects what the data was worth and what the preparation was worth. Organizations with tested backups and clear escalation paths have options. The preparation gap is what determined the demand, not the perimeter.