The Hidden First Step in Healthcare Ransomware Attacks Revealed | 2 Minute Drill with Drex DeFord

Ransomware attacks don't always start with a ransomware gang. They start with someone who gets paid to find the door.

Aleksey Volkov, known online as ChewbaccaCore, was an initial access broker. His job was identifying vulnerable companies, exploiting their networks, establishing a foothold, and selling that access on dark web marketplaces. Over 16 months in 2021-2022, his work enabled attacks on seven confirmed US businesses, resulting in $9M in confirmed losses and $24M in intended ransom demands. In March 2026, he was sentenced to 81 months in federal prison.

For healthcare leaders, the takeaway is uncomfortable: healthcare organizations are premium listings on these dark web markets. Legacy systems, large vendor and contractor ecosystems, high-value data, massive operational disruption risk, and historically thin security investment relative to exposure all show up in the listing price.

Someone may have already found a way into your network. They may be holding it. It may have already been sold. Stopping a ransomware gang when they arrive is one problem. Knowing whether someone has already been paid to find the door is a different one.

Remember, Stay a Little Paranoid

X: This Week Health

LinkedIn: This Week Health

Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer