From ransomware to data breaches, hospitals around the world are learning that cyberattacks are no longer rare — or containable. Hospitals must now be equipped to respond to cyberattacks — not just hope to avoid them. What if the next patient safety crisis comes from a cyberattack, not an infection? We believe cyber control belongs alongside infection control in hospitals — as a leadership issue, not just an IT concern. Hospital leaders must ensure the basics are in place: reliable data backups, timely system updates, staff who can spot phishing attempts, and well-rehearsed recovery plans. Like infection control, cyber hygiene only works when leadership treats it as essential — not optional.

South African hospitals remain dangerously exposed to cyberattacks because boards and executives still treat cybersecurity as an IT issue, not a governance or patient safety priority. Nexus Advisory observes five interconnected factors—ranging from resource constraints and weak risk perception to systemic, cultural, and ransomware-specific challenges—that explain why many public and private healthcare providers remain reluctant to invest adequately in cyber resilience. This is precisely why cybersecurity has to become a boardroom issue for hospitals.