&gt; <i>I think (right now) there isn&#x27;t a way to really mass-target people illegally if you have their medical data. Blackmail requires some non-zero amount of effort per user.</i><p>I&#x27;m saying that&#x27;s not really true anymore. These systems have patient email addresses and their medical histories. It&#x27;s doesn&#x27;t seem to me a big leap to automate ransomware. Hell, there&#x27;s plenty of encryption-based ransomware schemes active right now and they involve needing access to the target&#x27;s local PC. This doesn&#x27;t even require that. One massive healthcare breach and anyone who can pull it down on bit-torrent can start going to town extorting.<p>I think it&#x27;s something that&#x27;s been a practical possibility for a couple-few years now. Just hasn&#x27;t happened yet.