The health ministry plans a major strengthening of cybersecurity at medical institutions in the next fiscal year, judging that ransomware attacks now threaten the stable delivery of medical care. The ministry has requested ¥13.7 billion for the work in its budget request for fiscal 2027, against ¥100 million in the initial budget for fiscal 2026.
A ransomware attack can leave a hospital unable to use electronic medical records and disrupt treatment for an extended period. Surveys by the ministry and others have found that many hospitals have numerous connection points to outside networks, including VPN devices kept for maintenance, that are difficult to manage and monitor. The same surveys found that hospitals lack cybersecurity specialists.
Attack routes into hospitals have run through exactly such neglected connections. That was the case at Nippon Medical School Musashi Kosugi Hospital in Kawasaki, where the leak of personal information on about 130,000 patients and staff was confirmed in February.
What the money would pay for
The ministry says it will support hospitals across three areas: people, organization and systems. The program would help hospitals consolidate external connection points so they can be managed and monitored more efficiently.
It would also promote the use of security specialists through a list compiled by the Information-technology Promotion Agency (IPA), a government-affiliated body, and support hospitals' initial response when a cybersecurity incident occurs.
The threat is not confined to medical institutions. Attacks have also hit private companies, including those in the GMO Internet Group.