In September 2026, reports circulating on the open web alleged that the ransomware group Rhysida listed a Philippine hospital with a large data claim and a crypto ask. Treat that as context, not proof — and do not plan your budget around one unconfirmed ransom number.
What every clinic can plan around is simpler: when clinical systems and workstations stop, revenue and care stop. Small practices feel that first. Medium multi-doctor clinics feel it across billing and labs. Large clinics and hospital outpatient fleets feel it as multi-day recovery. Endpoint protection exists to shrink that outage — not to win a headline.
If your practice still runs on consumer antivirus, the useful question is not “would we pay 8 BTC?” It is: how many clinic hours can we afford offline?
Why downtime hits clinics harder than the ransom slide
Ransomware on a clinic network typically takes down:
- EHR / HIS access and e-prescriptions
- Appointment and billing systems
- Shared drives with PhilHealth claims, labs, and payroll
- Workstations doctors and nurses actually use
Until those come back, you cancel or paper-chart, lose same-day revenue, pay staff who cannot work normally, then pay overtime and IT to catch up. That stack is downtime cost. Industry research consistently shows healthcare pays more than other sectors when breaches and outages land — and small doctors’ offices are called out as especially exposed because they rarely have dedicated security staff (ITIC Hourly Cost of Downtime Survey commentary on medical offices and clinics).
For how the door usually opens, see how ransomware gets into a PH business and what phishing is.
Attributed figures (the spine of this piece)
| Source | What it says (use as published) | How we use it here |
|---|---|---|
| IBM Cost of a Data Breach Report 2025 (Ponemon) | Healthcare average breach cost USD 7.42 million — still the highest of any industry studied (14th consecutive year at the top); down from USD 9.77 million in the 2024 report. Healthcare also took the longest to identify and contain at 279 days vs a global average near 241 days. | Ceiling / industry gravity — not a PH solo-clinic invoice. Shows why “healthcare is expensive when it breaks.” |
| IBM Cost of a Data Breach Report 2024 | Global average breach cost USD 4.88 million; 70% of breached orgs reported significant or very significant disruption. | Disruption is normal, not rare. |
| ITIC 2024 Hourly Cost of Downtime Survey | Over 90% of mid-size and large enterprises report average hourly downtime above USD 300,000 (ex-litigation). Among SMBs with 20–100 employees, 57% reported hourly downtime costs up to USD 100,000. ITIC notes medical offices and clinics as vulnerable micro/SMB targets with weak onsite security staffing. | Directional bands for medium and large clinic IT — convert carefully; PH peso framing is illustrative FX only. |
| Modeled 4-provider clinic EHR outage (TechManager AI scenario, Feb 2025) | Single 4-hour EHR outage estimated at ~USD 29,300 total (~USD 7,325 / hour), bundling lost revenue, staff productivity/overtime, remediation, and patient attrition — before a security-incident forensic/legal overlay. | Best public small-clinic hour model we cite; labeled modeled scenario, not IBM. |
FX for PHP framing only: ~₱62.59 per USD (market indication ~10 Sep 2026). Not a BSP official daily for budgeting contracts.
Alleged leak-site ransom asks (crypto) are optional color at the end of a paragraph — never the lead number.
Risk analysis by clinic size (downtime-first)
Definitions for this article (PH practice framing):
| Segment | Typical shape | Managed seats (planning) |
|---|---|---|
| Small clinic | Solo / 1–3 doctors, reception + few clinical PCs | ~8–20 |
| Medium clinic | Multi-doctor / multi-specialty, shared EHR, billing team | ~30–60 |
| Large clinic | Multi-site OPD / hospital outpatient IT fleet | ~100–250+ |
Small clinic — downtime is the whole story
Risk profile: One encrypted file server or a handful of clinical PCs can stop the day. No SOC, often no full-time IT. Paper fallback is slow and error-prone. Patient trust damage is personal — your name is on the door.
Downtime math (attributed model, then scaled):
- Modeled ~USD 7,300 / hour for a 4-provider-style EHR outage (TechManager scenario above).
- One clinical half-day (4 hours) ≈ ~USD 29k ≈ ₱1.8M in that model.
- A ransomware recovery that takes 3 clinical days (3 × 8 hours) lands near ~USD 175k ≈ ₱11M on the same hourly assumption — still without forensics, legal notice, or any ransom.
Compare to protection (illustrative, ara.ph calculator high estimates): ~15 seats × EPP + EDR ~$150 / device / yr ≈ ~$2,250 / yr ≈ ₱141k. Even a single half-day outage in the small-clinic model can exceed a full year of endpoint licences.
Danger: Cancelled consults, PhilHealth claim backlog, staff idle + overtime, doctor reputation in a tight local market.
Pros of setup: Cheap relative to one bad week; one console; fits lean ops.
Medium clinic — hours multiply across billing and labs
Risk profile: More concurrent appointments, lab/imaging handoffs, and billing staff. An outage hits several revenue lines at once. Still often understaffed for security. ITIC’s SMB band (20–100 employees) is the closest survey peer: 57% reported hourly downtime up to USD 100,000.
Downtime math (bands, not a quote):
| Outage length | If you use the small-clinic ~$7.3k/hr model (conservative for mid size) | If you sit nearer ITIC SMB “up to $100k/hr” (upper survey band) |
|---|---|---|
| 4 hours | ~$29k ≈ ₱1.8M | up to ~$400k ≈ ₱25M |
| 1 clinical day (8 h) | ~$59k ≈ ₱3.7M | up to ~$800k ≈ ₱50M |
| 3 clinical days | ~$175k ≈ ₱11M | survey-upper figures become existential for most PH mid clinics |
Use the left column for planning conversations unless your own finance team has measured hourly clinic revenue + payroll burn. The right column is a published SMB survey ceiling — not a PH price list.
Compare to protection: ~50 seats × EPP+EDR ≈ ~$7,500 / yr ≈ ₱469k (calculator illustrative). That is still a fraction of one bad clinical day under either framing.
Danger: Multi-department stoppage, claim delays, overtime, possible patient diversion to competitors.
Pros of setup: EDR visibility across seats; same reseller story as you grow; optional M365 Collaboration Protection when mail carries claims or results.
Large clinic / hospital outpatient — industry gravity + long containment
Risk profile: Multi-site OPD, denser HIS integrations, more privileged workstations. Recovery is measured in days to weeks, not hours. IBM’s healthcare averages (USD 7.42M in the 2025 report; USD 9.77M in 2024) and 279-day identify-and-contain time describe large, studied organizations — treat them as sector gravity, not your exact PO. ITIC finds 90%+ of mid/large firms above USD 300,000 per hour of downtime (ex-litigation).
Downtime math (directional):
| Planning view | Figure | Note |
|---|---|---|
| ITIC mid/large hourly band | >$300,000 / hour for 90%+ of surveyed mid/large firms | Excludes litigation; healthcare called out as regulated and high-stakes |
| IBM healthcare breach average (2025 report) | USD 7.42M average cost | Includes detection, response, lost business, etc. — not “ransom only” |
| Containment lag (IBM 2025) | 279 days average to identify + contain in healthcare | Longer outage and longer uncertainty than the global average |
Even one hour in the ITIC mid/large band dwarfs a year of endpoint licences for a 200-seat fleet (~$30,000 / yr ≈ ₱1.88M EPP+EDR on the calculator model).
Danger: Multi-site clinical disruption, contractual/SLA exposure, large patient notification burden if data is involved, leadership and board scrutiny.
Pros of setup: Fleet-standard Elements (EPP+EDR), optional MDR where night risk warrants it, architecture that pairs endpoints with edge/identity — see Enterprise Cybersecurity Architecture.
Danger vs pros (summary)
| Stay on consumer / unmanaged AV | Managed WithSecure Elements (EPP + EDR) | |
|---|---|---|
| What fails first | Clinical day (EHR, billing, shared drives) | Same door — but prevention + EDR shorten dwell time |
| Small clinic | Half-day outage can exceed a year of licences | ~₱141k/yr illustrative for ~15 seats |
| Medium clinic | One day offline hits multiple revenue lines | ~₱469k/yr illustrative for ~50 seats |
| Large clinic | Hours cost six figures USD in ITIC mid/large bands | ~₱1.88M/yr illustrative for ~200 seats |
| Ops | Firefighting after the fact | One reseller story; policies you can run |
| Honest limit | “Free” until the outage | Licences ≠ backups, MFA, or segmentation |
Pros of getting set up
- Turns an unpredictable multi-day outage into a predictable annual operating expense
- WithSecure Elements only in ARA’s practice (we do not pitch Heimdal or Bitdefender)
- Clear path: health check → seat count → deploy — book Usap Tayo
Cons / limits
- Not free; calculator rates are high planning estimates, not locked quotes
- Agents do not replace offline backups or identity hygiene
- Legacy clinical PCs that cannot run an agent need compensating controls
What “getting something set up” costs (planning ranges)
From the public CyberSecurity Calculator (illustrative high estimates, not quotes):
| WithSecure Elements line | ~USD / device / year |
|---|---|
| EPP Premium | ~$100 |
| EPP Premium + EDR | ~$150 |
| WithSecure for Mobile | ~$80 |
| Segment | Seats | EPP + EDR / yr (illustrative) |
|---|---|---|
| Small | ~15 | ~$2,250 ≈ ₱141k |
| Medium | ~50 | ~$7,500 ≈ ₱469k |
| Large | ~200 | ~$30,000 ≈ ₱1.88M |
Typical path: cyber health check → licence order → agent rollout / harden → optional Collaboration Protection or MDR. Confirm engagement fees with ARA before locking a PO. More on the product path: WithSecure Philippines. Endpoint hygiene checklist: top 5 endpoint security questions.
What to do this week
- Inventory clinical and billing seats that must stay up.
- Estimate your own hourly burn — cancelled consults + staff cost + overtime (finance can do this in one afternoon).
- Verify backups ransomware cannot encrypt in place.
- Replace consumer AV with managed EPP + EDR on those seats.
- Scope with a short Usap Tayo health check; use the calculator only for internal framing.
Bottom line
Do not bank on one alleged ransom headline. Bank on hours of clinic you cannot open.
- Small: a modeled half-day EHR outage (~USD 29k / ~₱1.8M) can already exceed a year of EPP+EDR for ~15 seats.
- Medium: even conservative multi-day downtime outruns ~₱0.47M/yr licence framing.
- Large: ITIC mid/large hourly bands and IBM’s healthcare breach averages make fleet endpoint spend look like insurance with a receipt.
Endpoint protection is an operating expense. Clinic downtime is a balance-sheet — and a care — event.
Soft next step: Usap Tayo — map seats and a WithSecure Elements path sized to your clinic. Recommendations first, honest scoping, no fake logos.
