A Threat That Is Happening Now
This is not a forward-looking advisory. Following coordinated U.S. and Israeli strikes on Iranian military targets on February 28, 2026, the Department of Homeland Security issued a law enforcement bulletin warning of imminent cyberattacks against U.S. networks. The bulletin, obtained by ABC News, stated that Iranian-aligned hacktivists are expected to conduct cyberattacks against U.S. networks in the near term and that cyber actors affiliated with the Iranian government may conduct broader attacks against U.S. networks.
For health system leaders and revenue cycle teams, the question is not whether Iranian cyber operations represent a real threat. The question is whether your organization is prepared to operate if systems go down because of one.
The Threat Is Decentralized and Unpredictable
One of the most important aspects of the current threat environment is how decentralized it has become. Former NSA operative Kathryn Raines, now a threat intelligence team lead at Flashpoint, described the current moment as one in which loosely coordinated proxy actors are taking the lead in escalation, filling the vacuum left by Iran's central command structure.
In practical terms, this means the threat does not operate like a formal military campaign with defined targets and red lines. Smaller groups or individuals may begin selecting targets independently — making risk modeling far more difficult for security teams accustomed to tracking formal state actors.
Former CIA Special Activities Center director Brian Carbaugh put it plainly: cyber operations are appealing in moments like this precisely because they are low-cost, difficult to attribute, and capable of producing outsized disruption. Iran's cyber apparatus has over 15 years of documented operational experience and historically intensifies during periods of geopolitical pressure.
According to Flashpoint, groups operating under Iran's "Great Epic" campaign and "Cyber Islamic Resistance" are coordinating through Telegram channels and Reddit, posting claimed attacks publicly to amplify psychological impact even before technical verification is possible.
Why Healthcare Is Specifically at Risk
Iranian-linked threat groups have a documented history of targeting U.S. healthcare. In 2021, the FBI warned that Iranian actors had attempted a cyberattack on Boston Children's Hospital. The American Hospital Association warned in late 2025 that Iranian actors were actively compromising healthcare infrastructure and selling that access to secondary threat actors who then deploy ransomware.
| Attack Method | How It Works | Healthcare Entry Point |
|---|---|---|
| Password Spraying | Automated attempts across many accounts using common passwords | Staff email and EHR login portals |
| MFA Push Bombing | Flood user with authentication requests until they approve | Remote access and VPN accounts |
| Spear Phishing | Targeted emails impersonating trusted contacts | Billing staff and revenue cycle teams |
| Unpatched CVEs | Exploit known software vulnerabilities before organizations patch | Internet-facing devices and vendor portals |
| Supply Chain Compromise | Breach upstream vendor to gain access to downstream clients | Clearinghouses and billing platform integrations |
Once inside, access is often monetized by being sold to ransomware groups who then conduct the destructive phase. The interconnected nature of healthcare operations makes this particularly dangerous — revenue cycle teams work with clearinghouses, payer portals, billing platforms, and coding vendors, each with its own credential footprint and network access.
What an Attack Actually Looks Like for a Health System
For revenue cycle teams, the operational impact of an Iranian-linked cyberattack follows a well-established pattern.
| Phase | What Happens | Revenue Cycle Impact |
|---|---|---|
| Initial Access | Attacker gains entry through phishing or unpatched system | None visible yet — attacker moves quietly |
| Persistence | Attacker establishes foothold; may remain undetected for weeks | None visible — access being mapped and sold |
| Deployment | Ransomware encrypts systems; data exfiltrated | EHR goes offline; all digital workflows stop |
| Downtime | Organization operates on manual procedures | Charges missed; documentation incomplete; billing halted |
| Recovery | Systems restored; paper records reconciled | Weeks of backlog; denial spikes; compliance gaps surface |
Healthcare organizations that have invested in operational downtime preparedness — with tested workflows, trained staff, and technology that allows revenue cycle operations to continue independent of primary systems — absorb these events very differently than those that have not.
What Health System Leaders Should Do Right Now
The federal guidance issued in connection with the current threat environment is consistent and specific. Here is what CISA, HHS ASPR, and the FBI recommend healthcare organizations act on immediately.
- Patch every internet-facing asset — Iranian actors exploit known vulnerabilities quickly after public disclosure
- Implement MFA that resists push bombing across all remote access and administrative accounts
- Audit vendor and third-party access — scope each integration to least privilege
- Review clearinghouse and billing platform connections for unusual activity
- Verify downtime procedures exist, are accessible to frontline staff, and have been tested under realistic conditions
- Ensure revenue cycle workflows are operable without EHR access for multi-day scenarios
On the operational side, now is the time to verify that downtime procedures actually work. Most hospital downtime plans were written for brief, localized outages — not multi-day system-wide disruptions of the kind that ransomware deployments produce.
If your organization has not tested its revenue cycle workflows under full EHR unavailability, you do not know whether they will hold under pressure.
Preparedness Is the Answer to Unpredictability
The decentralized nature of the current Iranian cyber threat makes traditional risk modeling harder. When attacks can come from loosely coordinated actors selecting targets opportunistically through encrypted chat channels, the question of whether your specific organization is on a target list becomes less answerable than the question of whether your organization is prepared for disruption regardless of source.
Whether the next downtime event comes from Iranian-affiliated hacktivists, a ransomware group, or a routine system failure, the operational impact on revenue cycle is the same. Registration stops. Charges are missed. Billing is delayed. Recovery takes longer than expected.
The organizations that fare best are those that have already answered the question of how they will operate when their systems are unavailable. That answer requires more than a policy document. It requires tested procedures, trained staff, and the operational infrastructure to keep revenue cycle running when primary systems cannot.
The threat environment right now is elevated. That is not a reason to panic. It is a reason to assess your preparedness honestly and close the gaps before the clock starts.