Hive’s takedown removed a supplier, not the ransomware market

The week

On January 26, 2023, the Justice Department announced that the FBI, working with German and Dutch authorities, had disrupted the Hive ransomware group and seized the servers and websites it used. According to the department, the FBI had been inside Hive’s network since July 2022. It had given more than 300 decryption keys to victims under attack and more than 1,000 to earlier victims, preventing about $130 million in ransom payments. The department said Hive had targeted more than 1,500 victims in over 80 countries, including hospitals, school districts, financial firms and critical infrastructure. Hive ran as ransomware-as-a-service, renting its tools to affiliates who carried out intrusions. The announcement cited a Hive attack on a Midwest hospital that left it unable to accept new patients.

The Hive operation was new in one respect: investigators sat inside a ransomware group’s infrastructure for months, quietly handing keys to victims. For hospitals it was welcome news. It was also easy to misread as a change in the threat. The takedown affected three things very differently: the specific group, the ransomware economy around it, and each hospital’s own exposure. Only the first was materially reduced.

The specific group

Hive itself was finished as a brand. Its leak site went dark, its infrastructure was seized, and its affiliates lost the platform they had rented. Victims caught mid-attack in late 2022 recovered without paying. That outcome was real, and the numbers the Justice Department published were large.

For a hospital’s security team, the direct effect was narrow. Detection rules and indicator lists written for Hive’s specific malware lost most of their value overnight. Threat briefings to boards that named Hive as a top risk needed updating. Any hospital that had been hit by Hive and still held encrypted data had a reason to ask the FBI whether a key existed.

The more important effect was on decision-making. The operation showed that payment is not the only path to recovery. That strengthens the position of executives who prefer not to pay. It does not help a hospital that has no usable backups when the next attack arrives, because keys from a law enforcement operation are a rare outcome, not a recovery plan. Decryption keys also do nothing about stolen data. Most groups by then copied records before encrypting them, so a hospital that recovered its systems for free could still face extortion, breach notification under HIPAA and litigation over the same incident.

The ransomware economy

Ransomware-as-a-service splits the work. Developers build and maintain the encryption tools, leak sites and payment systems. Affiliates break into networks, move through them and deploy the tools for a share of the ransom. Initial access brokers sell footholds to both. Taking down one developer group removes a supplier. The affiliates keep their skills, their stolen credentials and their existing footholds, and they can sign up with another platform within weeks. Developers can rebrand with new code.

That structure explains why group names are a poor basis for defense. The techniques Hive affiliates used were common across the market: exploiting exposed remote access and unpatched edge devices, logging in with stolen credentials, using legitimate administrative tools to move laterally, and deleting or encrypting backups before launching the main attack. Defenses aimed at those techniques stay useful whatever brand the attacker uses next. Defenses aimed at one group’s file hashes and infrastructure expire with the group.

For a health system, that suggests a shift in how threat intelligence is consumed. Ask providers and information sharing groups such as Health-ISAC for technique-level reporting, mapped to a common framework like MITRE ATT&CK. Then test whether detection and response actually catch those techniques in the hospital’s own environment. A purple-team exercise that simulates credential theft and backup deletion tells a CISO more than a list of active gang names.

The hospital’s own exposure

The third element was untouched. A hospital’s attack surface was the same the day after the announcement as the day before. The conditions that made hospitals attractive remained. Clinical systems cannot tolerate long downtime, which raises pressure to pay. Medical devices and business systems often share flat networks. Many vendors hold remote access. Security teams are small relative to the estate.

The work that reduces exposure is familiar and slow. It starts with multi-factor authentication on every remote access path, including accounts used by device manufacturers, revenue cycle partners and other vendors. It needs backups that cannot be deleted with the same administrative credentials attackers obtain inside the network, such as immutable or offline copies with separate credentials. Segmentation should stop an intruder on a registration workstation from reaching imaging or pharmacy systems. And clinical downtime procedures need regular rehearsal, so care continues on paper for days if needed.

Each item has a measurable target. Examples are the share of external access paths protected by phishing-resistant authentication, the time to restore the electronic health record from an isolated copy, and the number of network paths between clinical and business segments. Hospital boards can track those numbers quarterly. They mean more than a count of blocked attacks. Where a number is poor, the board can ask for a dated plan to fix it and check progress at the next meeting.

A takedown also creates a short window of attention. Boards ask questions, and budget conversations are easier. That moment is better spent funding the slow work than issuing reassurance. A hospital should also settle in advance, with its executives and counsel, how a ransom decision would be made, who makes it, and what information they would need. Those choices do not depend on which group attacks next.

With hindsight

The pattern repeated at larger scale. Law enforcement disrupted ALPHV/BlackCat in December 2023 and LockBit in February 2024. On February 21, 2024, an affiliate working with ALPHV attacked Change Healthcare, halting claims processing and many pharmacy transactions across the US for weeks. ALPHV then collected a reported ransom and disappeared, leaving the affiliate unpaid and the stolen data still in criminal hands. UnitedHealth Group later estimated that about 190 million people were affected, the largest healthcare breach reported to HHS. The episode confirmed that disrupting a brand does not remove its affiliates, and that a single third party can carry risk for much of the sector. HHS published voluntary cybersecurity performance goals for healthcare in January 2024. The technique-focused defenses and recovery targets above remain the measures that matter in 2026.