Key Points
- Unpatched software risks: Leaving systems unpatched is one of the leading causes of ransomware attacks and data breaches in 2025.
- Compliance risk: Failing to patch systems can lead to noncompliance with HIPAA, GDPR, and other data protection regulations.
- Exploitation surge: The 2025 Verizon DBIR shows that exploitation of known vulnerabilities now accounts for 20% of breaches, up 34% year-over-year.
- Third-party vulnerabilities: Nearly 30% of breaches involve third-party vendors, proving businesses are only as secure as their partners.
- Automated patching advantage: Automated patch management reduces risk, ensures compliance, and eliminates the delays of manual patching.
To patch or not to patch, that is not a question— it’s solid IT advice that applies to every business, whether you’re a small startup or an established organization. Threat actors continue to exploit unpatched software, which has devastating consequences for victims, including financial loss, disrupted workflow, and loss of consumer trust.
As such, it is not an exaggeration to label these incidents as IT Horror Stories in their own right (which is also the name of our podcast!), but a warning of the cost of a data breach and how you can prevent them. In this article, we list the numerous unpatched software risks and some patch management best practices.
🥷 Build a proactive security strategy and gain a competitive edge with the right patch management.
How unpatched software hurts businesses in 2025
Scarier than a possible curse by Aunt Gladys from Weapons or even holding the One Ring from Sauron, unpatched software remains the nightmare of every IT team. Let’s be clear: The cost of data breach is not just theoretical; it has tangible consequences that can significantly impact your bottom line, as these companies have found in their own IT horror story.
| Unpatched software horror story | # of records exposed | Terrifying plot twist |
| Salesforce customer data via ShinyHunters (August 2025): A hacking group claimed to have breached Salesforce through compromised integrations with third-party tools like Drift and SalesLoft, stealing huge amounts of CRM data. | 1.5 billion records across 760 global companies | According to TechRadar, the recent Salesloft Drift cyberattack may have also compromised some Google Workspace accounts. |
| Qantas Airways (July 2025): Australia’s flagship airline confirmed a cyberattack exposing data from its frequent flyer program and customer accounts. | Up to 6 million customer records | The breach originated from a third-party customer service platform, proving that even indirect systems can expose millions of records. |
| Global credential leaks (June 2025): An exclusive Cybernews investigation uncovered a massive dataset built from infostealer malware campaigns. | ~16 billion login credentials | According to Cybernews’ investigation, the dataset demonstrates how attackers weaponize stolen credentials from infected endpoints. Even patched systems may still be compromised if valid logins are resold and reused in credential-stuffing attacks. |
| Yale New Haven Health (April 2025): One of the largest healthcare providers in the U.S. had patient records compromised through a third-party vendor breach. | More than 5.5 million individuals | Delayed patching and vendor misconfigurations left systems exposed, once again highlighting healthcare’s vulnerability to supply chain attacks. |
| Hertz data breach via vendor Cleo (April 2025): Rental car company Hertz Global revealed that a vendor’s software flaws led to exposure of its customers’ personal data. The incidents occurred between October and December 2024. | The total number of affected customers remains unknown, but reports suggest at least 3,400 in Maine and 96,665 in Texas have been confirmed. (TechCrunch) | According to Reuters, attackers leveraged zero-day vulnerabilities in Cleo’s file-transfer platform, exposing contact details, driver’s license and credit card numbers, and in some cases Social Security or passport data. Hertz emphasized that its own network was not compromised and said there’s no evidence of misuse so far. |
| New York Blood Center (January 2025): A healthcare nonprofit saw patient and donor information exposed in a breach targeting its databases. | Around 194,000 people (TomsGuide) | Highly sensitive data such as Social Security numbers, IDs, and medical details were leaked, underscoring how critical yet under-protected healthcare systems remain. |
A closer look at data breaches and risk drivers in 2025
Here are some of the most striking incidents so far in 2025 that illustrate how unpatched software, vendor weaknesses, or misconfigurations continue to hurt businesses, even when core defenses are assumed strong.
Change Healthcare (2024–2025 impact)
Although the Change Healthcare ransomware attack occurred in February 2024, its ripple effects extended well into 2025, making it one of the most devastating breaches in U.S. healthcare history. The UnitedHealth-owned subsidiary was crippled for weeks, with 6 TB of data stolen (or around 192.7 million compromised individuals) and outages across hospitals and pharmacies nationwide. The financial toll has now ballooned to nearly $2.9 billion, and the U.S. Office for Civil Rights (OCR) continues to investigate potential HIPAA violations.
What makes Change Healthcare such a pivotal case is not only the scale of disruption but also how it exposed the fragility of healthcare IT systems dependent on legacy and unpatched software. Even months later, the breach is cited by regulators, insurers, and providers as a wake-up call for patch management, third-party risk oversight, and ransomware resilience.
Microsoft SharePoint “ToolShell” exploits
Microsoft confirmed “active” cyberattacks exploiting various on-premises SharePoint Servers in July 2025, which caused the company to release several emergency patches. The global attacks are believed to have compromised various companies and agencies, including the U.S. government. The scale of impact reflects how delayed patching in popular enterprise software can become a direct line into corporate networks.
Third-party breach risk skyrockets
According to the 2025 Verizon Data Breach Investigations Report (DBIR), about 30% of breaches now involve third-party or vendor systems, double what it was before. Exploitation of vulnerabilities has increased by ~34%, especially in vendor or partner ecosystems. This suggests that businesses are only as secure as their weakest vendor or partner.
FinWise insider attack
An insider threat impacted the personal information of around 700,000 FinWise customers last September 2025. According to the popular fintech firm, a former employee was able to access sensitive data after leaving them. This shows how lapses in system governance, including delayed deactivation of access and oversight, can be just as dangerous as unpatched software.
Jaguar Land Rover factory disruption
A cyberattack detected in late August 2025 forced Jaguar to halt production globally. While the company stated that “there was no evidence that any customer data had been taken,” they proactively shut down several systems to mitigate the impact. Experts suggest that this may have caused the company thousands of dollars in lost productivity.
What is unpatched software?
Unpatched software refers to applications or systems that contain known security vulnerabilities that have not yet been addressed through updates or patches. If exploited, these vulnerabilities can potentially compromise the affected system’s security.
As soon as software vendors discover and acknowledge these vulnerabilities, patches are developed to mitigate the identified risks. It is crucial to keep systems updated and patched using a clear patch management process. Failure to do so can expose systems to potential exploits, as threat actors are often aware of the vulnerabilities before patches are released.
Consequences of unpatched software
Leaving software unpatched and vulnerable creates some serious security weaknesse, such as:
- Security vulnerabilities: One of the most significant consequences of unpatched software is an increased risk of security vulnerabilities. When software is not up to date with the latest patches, it may contain known security vulnerabilities that can be exploited by hackers or other malicious actors.
- Compliance issues: Many organizations are subject to regulations, such as HIPAA and GDPR, that require them to maintain secure systems and software. If your software is not current with the latest patches, you may violate these regulations, resulting in fines, penalties, and other sanctions.
- Loss of data: Unpatched software can also result in the loss of sensitive data. If a security vulnerability is exploited, hackers may access and steal confidential information, such as personally identifiable information, customer data, or financial records.
- Damage to reputation: Data breaches and other security incidents can have a major impact on an organization’s reputation. If your organization is affected by a security incident due to unpatched software, it could damage your reputation and make it difficult to regain customers’ trust.
- Lost productivity: Besides the potential financial and reputational costs, unpatched software can also lead to lost productivity. If a security vulnerability is exploited and your systems are compromised, it can disrupt your operations and prevent your employees from working effectively.
- Overall, the consequences of unpatched software can be severe and far-reaching. Implementing patch management ensures that your systems and software are always up-to-date and secure.
Cybersecurity & vulnerability statistics
Neglecting software patches remains one of the most dangerous (but preventable) security mistakes businesses can make. Yet many executives still underestimate the true cost of downtime and breaches.
“Small business owners tend not to focus on security because they see it as a liability and a cost center,” says AJ Singh, Vice President of Product at NinjaOne. “They don’t consider the losses from outages.”
Let’s look at some of the top cybersecurity statistics of 2024-2025 to see just how important patching is for every IT team and business:
Malware and ransomware statistics
- According to Verizon’s 2025 Data Breach Investigations Report, exploitation of software vulnerabilities as an initial attack vector has risen to 20% of all breaches — up ~34% year-over-year.
- The same report found third-party and vendor involvement in breaches has doubled, now accounting for 30% of all confirmed breaches.
- The Sophos State of Ransomware 2025 report states that exploited vulnerabilities remain the most common technical root cause of ransomware attacks, accounting for 32% of all attacks.
- Comparitech reports that in H1 2025, there were 3,627 ransomware attacks globally, a 47% increase over H1 2024.
Endpoint management and patching cybersecurity statistics
NinjaOne’s cybersecurity statistics report emphasizes that:
- 45% of businesses do not have any cyber insurance cover whatsoever
- Of those that do have coverage, 37% aren’t covered for ransomware payments
- About 1 in 5 consumers fall victim to scams, particularly phishing links.
Unpatched vulnerabilities statistics
According to the cybersecurity statistics 2025 by Fortinet:
- The global average cost of a data breach crossed $4.88 million in 2024.
- The annual average cost of cybercrime will cross $23 trillion in 2027.
- By 2031, a ransomware attack will hit a business or consumer every 2 seconds, equating to 43,000 attacks per day.
How automated patching reduces security risks
Though reputable vendors typically offer free, automated patching for outdated software, the process can sometimes break down or cause software to malfunction.
“Patching is an uphill battle,” Singh says. “There are new threats out every day.” Our internal research at NinjaOne shows that 25-30% of Windows 10 patches fail, which is why we custom-built a utility to successfully execute the process and remediate threats.
Benefits of automated patching for IT teams
Automated patching is an indispensable tool for contemporary IT teams, offering a host of benefits that streamline and fortify operations.
- Reduces your workload: Automated patching significantly reduces the manual workload, ensuring that software updates and vulnerability patches are consistently applied without the need for continuous oversight. This efficiency minimizes human error and frees IT professionals to focus on more strategic tasks and projects.
- Ensures systems are properly updated: With cyber threats becoming increasingly sophisticated, automated patching ensures that systems are promptly updated, thereby reducing potential security breaches and safeguarding critical data.
- Ensures uniformity in updates: Automated patching’s “set it and forget it” nature ensures that all devices in a network are synchronized and compatible, reducing potential system conflicts or incompatibilities. This level of consistency also enhances system performance and reduces downtime, leading to increased productivity.
- Allows flexibility in IT teams: The capability to tailor patching at a granular level gives IT teams the flexibility to adapt to specific organizational needs, allowing for custom patch schedules or selective patch deployments. In essence, automated patching provides IT teams with a combination of efficiency, security, and flexibility, making it a cornerstone of effective IT management.
Discover how GSDSolutions was able to save time through automation.
“From a functionality perspective, patch management is really easy to setup and automate – and it really just works. Ninja’s integrations are fast and reliable. ”
Mark Andres, Director of IT Services at GSDSolutions
Secure your remote and hybrid endpoints with the #1 patch management tool, according to G2.
How to implement patch management
Before implementing patch management, ensure you have undergone these initial steps in your organization.
- Assessing needs: Before implementing patch management, it’s important to evaluate your organization’s needs. This helps you to determine the systems and software that need to be patched, as well as the frequency and scope of the patching process.
- Choosing a solution: There are many top patch management solutions available, including both commercial and open-source options. When selecting a solution, consider factors such as ease of use, compatibility with your existing systems, and the level of support provided.
- Getting the right people involved: Patch management is not a one-person job. It’s essential to involve the right people in the process, including IT staff, system administrators, and other relevant stakeholders. Training may also be necessary to ensure everyone knows how to use and implement the patch management solution correctly.
- Creating a policy: Patch management should be a long-term process, not just a one-time event. To ensure that patches are implemented consistently and effectively, it’s crucial to create a patch management policy that outlines the processes, procedures, and responsibilities involved. This policy should be reviewed and updated regularly to reflect your organization’s systems and software changes.
To implement patch management, follow these steps:
- Identify the systems and software that need to be patched. This can include operating systems, applications, and other types of software.
- Create a patch management schedule. Decide how often you will check for new patches and how you will implement them. For example, you can check for new patches once a week and implement them every month.
- Set up a patch management process. Determine who will be responsible for implementing patches and how they will be implemented. For example, you may decide to use a patch management tool to automate the process.
- Monitor the patch management process. Check regularly to ensure that patches are being implemented correctly and on schedule.
- Test patches before implementing them. Testing patches in a non-production environment is vital to ensure they don’t cause any issues before implementing them in your live systems.
- Keep track of all implemented patches. This will help you determine which systems and software are up to date and which may need to be patched in the future.
By following these steps, you can ensure that your systems and software are always up-to-date and secure.
Eliminate security threats with NinjaOne patching
NinjaOne Patch Management automates the entire patching lifecycle, from detection and deployment to verification and reporting, so IT teams can focus on strategic work instead of fighting fires.
With NinjaOne, you get:
- Automated patching across Windows, macOS, and third-party applications, helping you remediate vulnerabilities faster.
- Granular control with custom scheduling, testing, and rollout policies tailored to your organization’s needs.
- Real-time visibility into patch compliance, making regulatory audits and reporting straightforward.
- Reduced downtime and risk, thanks to reliable automation that keeps systems secure without disrupting productivity.
It’s no surprise that G2 ranked NinjaOne the #1 Patch Management Software in their latest report.
NinjaOne’s IT management software has no forced commitments and no hidden fees. If you’re ready, request a free quote, sign up for a 14-day free trial, or watch a demo.
