Proofpoint, Inc., a leading cybersecurity and compliance company, has today released new research showing almost one in four (23%) of Australia’s top-ranked hospitals is still lagging behind on basic cybersecurity measures, subjecting patients, healthcare professionals, and stakeholders to a higher risk of email fraud. While the data shows some progress since Proofpoint’s 2023 analysis, it still highlights the ongoing security gaps in the healthcare sector, which has been increasingly targeted by threat actors.

These findings are based on a Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of 70 Australian public and private hospitals. DMARC is an email validation protocol designed to protect domain names from being misused by cyber criminals, authenticating sender’s identities before allowing a message to reach its intended destination. It has three levels of protection^[1] – monitor, quarantine and reject, with reject being the most secure for preventing suspicious emails from ever reaching an inbox.

“The healthcare industry has become one of the most targeted sectors for cyber criminals due to the highly valuable data it stores, including patient identities, bank account details, and medical history, combined with limited resources focused on staying operational to provide patient care. This makes healthcare organisations a prime target and more vulnerable for cybercrime,” said Steve Moros, Senior Director, Advanced Technology Group, Asia Pacific and Japan at Proofpoint.

Recent research supports this trend, with the 2024 Ponemon Healthcare Cybersecurity Report finding that 92% of healthcare organisations experienced a cyberattack in 2024, up from 88% in 2023. Email remains a primary attack vector, identified as the second most targeted collaboration tool by 59% of IT professionals in healthcare. The COVID-19 pandemic further accelerated healthcare’s digital transformation through telehealth adoption in Australia, significantly expanding the cybersecurity attack surface while organisations simultaneously face cybersecurity talent shortages. Properly implementing DMARC to the highest level of protection – reject – will reduce the likelihood of being impacted by email spoofing, phishing attacks and Business Email Compromise (BEC), thus improving the cyber posture of the healthcare organisations.

“With more large-scale cyberattacks affecting Australian healthcare organisations including MediSecure and most recently Genea, implementing robust email security protocols like DMARC adds a critical layer of protection,” Moros added.

Proofpoint’s 2023 analysis found that while most top Australian hospitals (97%) used some form of DMARC protection, only 64% deployed the strongest ‘Reject’ policy. Today’s 2025 data show progress—all hospitals being analysed now use DMARC, and 77% implement the highest protection level. However, 23% of these institutions still use insufficient protection, potentially exposing patients, staff and stakeholders to email fraud.

“We’re encouraged by the improved DMARC adoption across Australian top hospitals, but a significant security gap remains. For healthcare institutions, strong cybersecurity isn’t just about protecting patient data, it directly impacts the quality of care Australians receive. Implementing DMARC at its highest protection level provides essential defence against email threats targeting these critical organisations,” concluded Moros.

The full findings of Proofpoint’s 2025 DMARC analysis of Australia’s top-ranked hospitals show:

• 100% of analysed hospitals now implement some form of DMARC protection (up from 97% in 2023)
• 77% of Australia’s hospitals have properly implemented DMARC to the recommended and highest level by blocking suspicious emails (up from 64% in 2023)
• 23 % of Australia’s hospitals remain at suboptimal protection levels:
  • 3% use DMARC – Quarantine
  • 20% use DMARC – Monitor

Below are some best practices for patients, staff, and other stakeholders:

• Check the validity of all email communication and be aware of potentially fraudulent emails impersonating colleagues, suppliers, and stakeholders.
• Be cautious of any communication attempts that request log-in credentials or threaten to suspend service or an account if a link isn’t clicked.
• Adopt phishing-resistant multifactor authentication, such as passkeys.

This DMARC analysis was conducted in February 2025 using data from the World’s Best Hospitals 2024 – Australia rankings