Against whom? Where is the profit mechanism? Are the hackers really prepared to track down every patient and try to blackmail them? It’s like the emails you get some times from hackers that have an old password of yours and threaten to release that video of you pleasuring yourself. Seriously?

Against the firm that let their patients' private data leak. Medical groups tend to have deep pockets.