Careful with this. This is not a black and white issue. Or should we go to the 90s where you could be fined because you "hacked" a MS webserver by typing ".." i

Careful with this. This is not a black and white issue. Or should we go to the 90s where you could be fined because you "hacked" a MS webserver by typing ".." in the URL bar and the webserver dutifully responded by showing you dir contents _outside_ the web root? Something which you could do almost by accident with a poorly managed copy & paste. There's not that clear balance between "the door was locked and I broke in" and "you were not even trying to secure this", and I would bet that most of these hospitals tilt to the later (MUMPS comes to mind), up to the point you can cause great havoc just by accident. So I would definitely argue against any absolute "everything is a malware attack" classification.