sebinspace , 11 months ago

Because it’s valuable.

Have to think, these people don’t have moral codes like you or I, so trying to find the logic in morality isn’t going to get you anywhere.

Now that we’re past the obstacle of morality, we can get to the meat of it:

1. Hospitals have valuable data and a lot of essential systems. The users of those systems would pay a lot to keep it functional and accessible.
2. They have massive attack surface. There’s so many vulnerable points in a hospital that one could imagine, with a few insights, a few attack vectors just walking around one and being observant.
3. The staff often aren’t educated in proper practices, the dos and don’ts of infosec, and are also often overworked and very tired. This leaves them vulnerable to phishing attacks, tailgating, you name it. Trained about tailgating? A lot of them use RFID cards to access specific areas, and cloning those is trivial.

TL;DR hospitals are valuable and (sadly) easy targets.