How Has Ransomware Changed the Requirements for Secure File Sharing?
Why modern ransomware makes secure file sharing depend on scoped access, Zero Trust verification, encryption, and tamper-proof audit trails.
On February 12, 2024, someone logged into Change Healthcare’s remote access system. A system that processes roughly 15 billion healthcare transactions a year and touches one in three patient records in the US didn’t require a second verification step - just a username and password. Nine days went by before anyone noticed. Change Healthcare isn’t an ordinary file-sharing tool - it’s a clearinghouse that thousands of hospitals, pharmacies, and insurers rely on every day to exchange data on patients and payments. That’s exactly what made the attack so damaging: access to one system meant access to everything connected to it.
Why can one point of access endanger thousands?
File-sharing systems exist precisely so the same data can be reached by many: a hospital, a pharmacy, and an insurer through one request; a manufacturer and its supplier through one shared folder. That’s exactly what makes them valuable. Yet many organizations still rely on file-sharing infrastructure that has grown over years - an aging FTP server, legacy integrations, or scripts that only one person fully understands.
That’s exactly why ransomware groups increasingly target file-sharing infrastructure instead of individual laptops. One successful login can become a path to every connected partner, application, or shared repository. Manufacturing remains the most frequently targeted industry because every hour of downtime is expensive. Healthcare, meanwhile, continues to experience the highest average cost per ransomware incident - around $7.42 million.
What happens during nine days of silence?
Attackers rarely encrypt data the moment they get in. In Change Healthcare’s case, they spent nine days moving through the system undetected and copying out 4 - 6 terabytes of data before the encryption code ever ran. That fits the broader pattern: the time from initial access to encryption now averages just 4 - 5 days, down from more than 70 just a few years ago.
What does trusting only what actually deserves trust look like?
Zero Trust doesn’t mean nobody can access anything. It means every connection is verified based on what it actually is - not because it has always been trusted. In practice, that means every partner, every connection, and every shared location receives only the access it genuinely needs. Nothing more.
These same principles - verifying every connection, encrypting data before it moves, and maintaining a complete record of every action - are no longer just security best practices. They are increasingly reflected in regulations such as the EU’s NIS2 directive across healthcare, manufacturing, public administration, and many other critical sectors.
Why does proving what happened matter more than just stopping it?
Change Healthcare contained the attack on February 21. Yet the exact number of people affected kept climbing for months, and notification letters reached people long after the fact - because there was no clear, tamper-proof record of exactly what had been reached, and when.
That’s precisely what a proper audit trail solves: every file movement, every flow, every login attempt gets recorded in a way that can’t be quietly deleted or rewritten - by chaining records together so any alteration becomes detectable. For an auditor, that changes the question from: “Is the data encrypted?” to: “Can we show who opened which specific file, when, and from where?” The answer can arrive in minutes instead of months.
So, what exactly did ransomware change?
Ransomware didn’t fundamentally change how companies exchange files. It changed what companies have to assume before they do.
Today, secure file sharing is no longer about keeping the wrong people out. It’s about assuming that someone may eventually get in - and designing systems that limit what they can reach, record what they do, and make every action traceable. The Change Healthcare attack began with a single login that trusted a password.
If the same thing happened in your organization tomorrow, how much of your data could one successful login actually reach?