In the ever-evolving landscape of cyber threats, the first half of 2026 has revealed a concerning trend: the finance and healthcare sectors in India continue to bear the brunt of malicious activities, with cybercriminals showing no signs of letting up. According to the government's data shared in Parliament, the healthcare sector alone recorded 18,855 instances of cyber threats in the first six months, a staggering 55% of the total 34,480 incidents detected and mitigated throughout 2025. This alarming statistic highlights the persistent vulnerability of the healthcare industry to cyberattacks, which could have dire consequences for patient care and data privacy.
What makes this situation particularly intriguing is the disparity between the healthcare and finance sectors. While the healthcare sector is grappling with a surge in cyber threats, the finance sector, which was previously a prime target, seems to have witnessed a slight respite. Between January and June, CERT-In detected and mitigated almost 3.5 lakh instances of malicious scanning, probing, and vulnerable services in the finance sector, a decrease from the 5.7 lakh incidents recorded in 2025. This could be attributed to the enhanced cybersecurity measures implemented by financial institutions in response to past attacks.
However, the story is not entirely positive for the finance sector. Targeted intrusion campaigns against banks did not show a similar decline. In the first half of 2026, CERT-In detected and mitigated 17 such campaigns, compared to 39 in the entire year of 2025. This suggests that while the overall threat landscape may be shifting, certain types of attacks are becoming more sophisticated and targeted, requiring banks to remain vigilant and adaptive.
One of the most significant developments in the first half of 2026 is the increased focus on cybersecurity preparedness for critical infrastructure. CERT-In conducted two exercises for the power sector, involving 274 participants from 103 organizations, including utilities, system operators, and generation, transmission, and distribution entities. One of these exercises specifically targeted emerging cybersecurity risks posed by frontier AI models, indicating that threats linked to advanced AI systems are now being incorporated into preparedness drills for critical infrastructure. This is a crucial step forward, as it acknowledges the evolving nature of cyber threats and the need to adapt to new technologies.
In my opinion, the data shared by the government highlights the ongoing battle between cybercriminals and cybersecurity professionals. While the healthcare sector remains a prime target, the finance sector is not entirely in the clear. The disparity in threat levels between the two sectors could be attributed to the varying levels of investment in cybersecurity infrastructure and the effectiveness of response strategies. The increased focus on cybersecurity preparedness for critical infrastructure is a positive development, but it also underscores the need for continuous innovation and adaptation in the face of evolving cyber threats.
Looking ahead, it is essential to monitor the trends and patterns emerging from the data. The healthcare sector's vulnerability to cyberattacks could have far-reaching implications for patient care and data privacy. The finance sector, on the other hand, must continue to invest in cybersecurity measures and adapt to the changing threat landscape. As we move forward, the collaboration between government agencies, cybersecurity professionals, and industry stakeholders will be crucial in building a more resilient and secure digital environment.
