Privacy remains at the core of cyber risk in managed care. MCOs maintain large repositories of protected health information, financial records, pharmacy data and behavioral health information, all of which are subject to federal and state regulation.

The challenge extends beyond preventing data exposures. Organizations must also manage how patient data is collected, stored, shared and used across a growing ecosystem of vendors, partners and technology platforms. The expanded use of AI and advanced analytics adds new complexity around data governance, consent and appropriate use of sensitive information. As privacy regulations continue to evolve and enforcement activity increases, balancing innovation with member trust is an ongoing operational priority.

AI is transforming healthcare administration, supporting clinical decision-making, automating claims workflows and improving operational efficiency. It also introduces new risks that many organizations are still working to address.

According to the Health Sector Coordinating Council's Cybersecurity Working Group, healthcare's accelerating AI adoption has expanded dependence on third-party tools and introduced complex cybersecurity challenges that traditional risk management models cannot fully address. These include data poisoning, model drift, adversarial attacks and limited visibility into AI vendor supply chains.

At the same time, threat actors are using AI to build more sophisticated phishing and social engineering attacks. A 2025 report from KnowBe4 found that 82 percent of phishing emails now use AI-generated content. Healthcare, which is the most susceptible industry to phishing at 41.9 percent of organizations affected, faces compounding exposure.

Many of the most significant cyber threats facing MCOs originate outside their own networks. MCOs depend on vendors, cloud providers, pharmacy benefit managers and outsourced service providers to deliver core functions. A cyber event affecting a critical vendor can disrupt multiple organizations simultaneously.

The February 2024 ransomware attack on Change Healthcare illustrated the systemic risk at scale. A single event at a claims processing subsidiary affected the majority of U.S. hospitals and physician practices, causing weeks of billing and payment disruption and resulting in reported losses of $2.9 billion to UnitedHealth Group. According to research published in JAMA Network Open, ransomware affected 69 percent of all patient records compromised in 2024.

Vendor risk management has evolved from a procurement and compliance function into a strategic business priority. Organizations that lack visibility into third-party security postures face significant exposure, regardless of how strong their internal controls may be.

Ransomware remains one of healthcare's most persistent cyber threats. While ransom demands in healthcare dropped significantly in 2025 according to Sophos research, the frequency of attacks continued to climb. Ransomware attacks targeting healthcare businesses, including the vendors and service providers MCOs rely on, increased 51 percent in 2025 compared to 2024.

Today's attacks frequently involve data exfiltration alongside encryption. Sophos found that the percentage of healthcare providers whose data was extorted without encryption tripled since 2023, reaching the highest rate reported across all sectors. For MCOs, the operational impact extends well beyond data loss, creating interruptions in claims processing, provider reimbursement and member services.

Organizations focused exclusively on prevention may find themselves underprepared when an incident occurs. Recovery planning, business continuity capabilities and tested incident response protocols have become core elements of a mature cyber program.

Managed care organizations face cyber risk across four primary areas: patient privacy and data protection, AI adoption, third-party and vendor dependencies, and ransomware. Of these, third-party risk has drawn significant attention following the 2024 Change Healthcare attack, which demonstrated how a single vendor incident can disrupt operations across hundreds of healthcare organizations simultaneously. Ransomware frequency also continues to rise, with attacks on healthcare businesses and their vendors increasing 51 percent in 2025.

Ransomware in managed care creates cascading operational disruptions that extend well beyond compromised data. Attacks routinely interrupt claims processing, delay provider reimbursements, take pharmacy systems offline and create gaps in member services. Modern ransomware attacks increasingly involve data exfiltration alongside encryption, meaning organizations face both operational and regulatory exposure. According to Sophos, the rate of data extortion without encryption in healthcare tripled between 2023 and 2025, reaching the highest level of any sector.

Third-party cyber risk refers to the exposure an organization inherits through its vendors, partners and service providers. For health plans and MCOs, this includes pharmacy benefit managers, claims processors, cloud platforms and outsourced administrative functions. A cyber incident at any of these providers can compromise member data, disrupt operations or trigger regulatory obligations, regardless of the health plan's own security controls. Effective vendor risk management requires visibility into third-party security postures, contractual protections, and contingency plans for critical dependencies.

AI governance in managed care requires organizations to go beyond evaluating clinical or operational performance. Cybersecurity considerations should be embedded into AI procurement, deployment and ongoing oversight. The Health Sector Coordinating Council's Cybersecurity Working Group recommends that healthcare organizations assess AI tools for risks including data poisoning, model drift, adversarial attacks and supply chain vulnerabilities. Organizations should also establish policies governing how AI systems access, process and store patient data, and ensure those policies are reviewed as regulatory guidance continues to evolve.

Operational resilience means an organization's ability to maintain or rapidly restore critical functions during and after a cyber incident. For managed care organizations, this includes continuity of claims processing, provider communications, pharmacy operations and member services. A resilience-focused cybersecurity program goes beyond perimeter defense to include incident response planning, business continuity capabilities, regular tabletop exercises and defined recovery time objectives for core systems. As cyber incidents become more frequent and operationally disruptive, resilience has become a core component of enterprise risk strategy.