Medical records, diagnoses, biometric data… Over a lifetime, we generate a vast amount of healthcare information about ourselves—data that, by its very nature, remains linked to us permanently. It is precisely this permanence that has increased its value on illegal marketplaces used by ransomware groups, access brokers and networks specialising in digital fraud. The growing digitalisation of hospitals, clinics and insurers has also significantly expanded the attack surface. Criminals have refined their methods for profiting from the theft, sale and extortion of highly sensitive information. Ransomware accounts for more than a third of criminal activity The latest analysis by TrendAI shows that ransomware now accounts for 36.3% of all activity detected on underground marketplaces linked to the healthcare sector. The attacks are no longer limited to encrypting servers and demanding a ransom. Threat actors now also extract large volumes of data before locking systems and use the stolen information as leverage. They threaten to publish or sell the stolen files if the affected organisation refuses to pay. This double-extortion strategy considerably increases the financial, reputational and legal impact on hospitals, laboratories and healthcare providers. "Unlike a credit card, a patient’s diagnoses, treatment history or biometric data cannot be cancelled and reissued. This makes healthcare organisations particularly attractive to ransomware groups and data brokers," explains José de la Cruz, Technical Director at TrendAI Iberia. A Highly Organised Underground Economy The study describes a criminal ecosystem that operates like a full-fledged supply chain. At the first stage are initial access brokers, who specialise in finding vulnerabilities and selling entry points into corporate networks. Ransomware groups then use that access to infiltrate networks, extract documents and encrypt the affected systems. Finally, specialised marketplaces sell medical records, login credentials, insurance data and complete identity packages, known in criminal circles as “fullz”. This division of