First, it's not impossible, it's just difficult. And however difficult it is, if those systems are necessary to maintain operation, then they're mission-critical and it's someone's job to make sure that they continue to operate.

Second, a ransomware attack isn't going to attack stuff like medical equipment, which wouldn't hold any important files anyway. It's going to attack workstations and servers likely running some version of Windows. If your IT staff can't keep that stuff backed up then you don't have IT staff.

It’s impossible to patch systems that are out of support and the security patch literally doesn’t exist. In some situations the original vendor themselves don’t even exist anymore.

Also regarding the servers and workstations, recovering from ransom ware isn’t as simple as just restoring from a backup. You’re still looking at days of effort restoring backups, reimaging workstations, and validating that everything works.

A vulnerable system that can't be patched shouldn't be in a position where that vulnerability can be exploited, if it's mission-critical. If it's mission-critical, it's vulnerable and can't be patched, and has to be exposed, then it's not fit for purpose and has to be replaced, or have a replacement (i.e. a backup) on stand-by.

Yes, restoring a backup requires effort. But surely less effort than losing the data altogether.

> I don’t think you grasp the hodgepodge of obsolete computer systems that are attached to computer networks to run lab equipment, MRI machines, process pharmacy prescriptions, and manage a patient’s chart. Keeping all of this secure and properly backed up is pretty much impossible.

> Seriously, I’ve seen machines in use running everything from ancient versions of Sun Solaris to Windows 95.

And yet the parking lot will be full of BMW and Porsches. There's definitely money coming-in; why not spend it on making sure the infra can perform when needed?

How much money do these institutions make again...?

You could basically say the spirit of everything you're saying about banks.

The hospitals themselves operate on relatively thin margins usually. Insurance companies, labor costs, pharmaceuticals, blood products, single use sterile items, housekeeping, taking care of uninsured patients that can’t pay the bills, and other regulatory requirements are extremely costly and eat up most of the budget. Reinvesting in IT infrastructure isn’t something that is a priority.