Healthcare Data Breach Statistics 2026
By: Axis Intelligence Research Desk & Marcus Chen
Last Updated: June 12, 2026
Next Scheduled Update: Q3 2026 (September 2026)
License: Data available for download under CC BY 4.0
Quick Answer: As of June 2026, healthcare has suffered 772 confirmed large-scale data breaches in 2025 alone — the worst annual total ever recorded — exposing the protected health information (PHI) of more than 139 million individuals. Since 2009, cumulative U.S. healthcare breaches have impacted over one billion Americans, 2.9 times the current population, at an average organizational cost of $7.42 million per incident — the highest of any industry for 14 consecutive years.
Key Findings
- 772 large healthcare data breaches (affecting 500+ individuals) were confirmed in 2025, the highest annual total ever recorded by the HHS Office for Civil Rights, surpassing the previous record of 746 set in 2023.
- $7.42 million is the average cost of a single healthcare data breach in 2025, marking 14 consecutive years as the most expensive sector globally, according to IBM’s Cost of a Data Breach Report 2025.
- Over 1.01 billion Americans have had their PHI exposed or stolen since 2009, representing 2.9× the current U.S. population — meaning statistically, if you have ever received healthcare in the United States, your medical records have likely been compromised at least once.
- 48% of all healthcare breaches now involve ransomware, up from 44% in 2025, per the Verizon 2026 Data Breach Investigations Report, with vulnerability exploitation replacing stolen credentials as the #1 initial access vector for the first time in 19 years of DBIR reporting.
- 32% of healthcare organizations reported increases in patient mortality rates following a cyberattack in 2025, a significant jump from 26% the year prior, per the 2025 Ponemon/Proofpoint Cyber Insecurity in Healthcare study.
The Axis Intelligence Healthcare Breach Risk Index (HBRI™ 2026)
A cross-source proprietary metric developed by Axis Intelligence — this figure does not appear in any single published report.
Existing reports measure breach cost (IBM), breach frequency (HHS OCR), and breach detection time (IBM/Verizon) in isolation. No published source combines all three into a unified severity score. Axis Intelligence has constructed the Healthcare Breach Risk Index (HBRI™), which normalizes these three dimensions into a single comparable score across the 2020–2025 period.
Methodology:
HBRI™ = (Average Breach Cost in $M × Annual Breach Count × Mean Detection Time in Days) ÷ 10,000
| Year | Avg Cost ($M) | Annual Breaches | Detect Time (days) | HBRI™ Score |
|---|---|---|---|---|
| 2020 | 7.13 | 642 | 239 | 109.2 |
| 2021 | 9.23 | 714 | 287 | 189.1 |
| 2022 | 10.10 | 700 | 277 | 195.9 |
| 2023 | 10.93 | 746 | 279 | 227.6 |
| 2024 | 9.77 | 742 | 279 | 202.5 |
| 2025 | 7.42 | 772 | 279 | 159.7 |
Sources used: IBM Cost of a Data Breach Reports 2020–2025 (breach cost and detection time); HHS OCR Breach Portal data 2020–2025 (annual breach count, as compiled by HIPAA Journal from the official portal at ocrportal.hhs.gov).
What the HBRI™ reveals: Despite the 2025 cost decrease (IBM attributes this to faster AI-assisted containment), the breach frequency reached a historic peak. The HBRI™ score of 159.7 for 2025 is higher than 2020 (109.2), confirming that the sector’s aggregate risk position has not improved — it has worsened considerably since 2020. The 2023 peak (227.6) remains the single most dangerous year in the index’s history.
Citation: Axis Intelligence Research Desk. “Healthcare Breach Risk Index (HBRI™) 2020–2025.” Axis Intelligence, June 12, 2026. https://axis-intelligence.com/healthcare-data-breach-statistics/
Breach Volume & Scale — The OCR Breach Portal Data
The HHS Office for Civil Rights maintains the authoritative public database of healthcare breaches affecting 500 or more individuals. Known as the “Wall of Shame,” the OCR Breach Portal is the primary source for U.S. breach volume data.
Annual Large Breach Totals (500+ individuals), 2018–2025
| Year | Confirmed Breaches | Individuals Affected | Breaches/Day |
|---|---|---|---|
| 2018 | ~365 | ~13.2M | ~1.0 |
| 2019 | 512 | ~40.0M | ~1.4 |
| 2020 | 642 | ~29.3M | ~1.8 |
| 2021 | 714 | ~44.9M | ~1.96 |
| 2022 | 700 | ~41.7M | ~1.92 |
| 2023 | 746 | ~183M (record) | ~2.04 |
| 2024 | 742 | ~289.8M (Change Healthcare) | ~2.03 |
| 2025 | 772 (new record) | 139.7M | ~2.12 |
Source: HHS OCR Breach Portal (ocrportal.hhs.gov); data compiled as of June 2026. 2025 total reflects 772 confirmed breaches; further additions expected as OCR processes delayed reports following the 43-day government shutdown in late 2025.
What the data actually says: 2024’s massive affected-individual count (289.8 million) is dominated by a single incident — the Change Healthcare ransomware attack, which alone compromised the PHI of approximately 192.7 million individuals, later confirmed by HHS. Stripping that outlier, 2025’s 139.7 million individuals affected across 772 breach incidents is a sobering figure. It underscores a structural problem: the frequency of intrusions is at a historic high even as individual megabreaches fluctuate year to year.
Between 2009 and the end of 2025, the HHS OCR portal has recorded 7,418 large healthcare data breaches affecting a cumulative total of more than 1.01 billion individuals — more than 2.9 times the entire current U.S. population. This figure, first crossing the one-billion threshold in 2025, represents a landmark in healthcare cybersecurity history that has received insufficient public attention.
As the HHS Breach Notification Rule requires covered entities to report breaches of unsecured PHI within 60 days of discovery for large incidents, these numbers likely undercount actual exposures, particularly for breaches affecting fewer than 500 individuals, which are reported only annually.
Who Is Being Breached?
According to HHS OCR and Verizon 2026 DBIR data:
- Healthcare providers account for 73% of breach reports (by reporting entity), though when measured by where the breach occurred, providers represent 62%
- Business associates (third-party vendors) are involved in 34% of healthcare breaches — a figure that doubled year-over-year between 2023 and 2025, per Verizon DBIR analysis
- Health plans account for approximately 11% of breaches
- Small practices (under 100 employees) face a 6× higher attack rate than in 2021, as threat actors target organizations with minimal security resources
Financial Cost of Healthcare Data Breaches
The $7.42 Million Per-Breach Reality
IBM Security’s annual Cost of a Data Breach Report — produced with the Ponemon Institute across 600 organizations globally — has tracked healthcare breach costs for two decades. The 2025 edition, covering breaches from mid-2024 to mid-2025, confirms that healthcare maintained its position as the costliest industry for the 14th consecutive year.
| Industry | Avg Breach Cost 2025 | vs. 2024 | vs. Global Avg |
|---|---|---|---|
| Healthcare | $7.42M | ▼ $2.35M | +67% |
| Financial Services | $5.56M | ▼ slight | +25% |
| Industrial | $5.00M | — | +13% |
| Energy | $4.83M | — | +9% |
| Technology | $4.79M | — | +8% |
| Global Average | $4.44M | ▼ 9% | — |
| U.S. Average (all industries) | $10.22M | ▲ 9.2% | +130% |
Source: IBM Cost of a Data Breach Report 2025, released July 2025. Methodology: activity-based costing across 600 organizations, 16 countries.
The 2025 global decline (the first in five years) masks a critical U.S.-specific trend: American organizations experienced a record $10.22 million average breach cost, up 9.2% from 2024’s $9.36 million. For U.S. healthcare specifically, the combination of HIPAA enforcement penalties, patient notification requirements, and operational disruption pushes per-incident costs well above the global healthcare average.
Why healthcare costs have been highest for 14 years running:
According to IBM’s analysis, three structural factors explain healthcare’s persistent position at the top:
- PHI regulatory burden: HIPAA violations can carry penalties up to $2 million per violation category. Compliance costs — both pre-breach (security controls) and post-breach (notification, audit, remediation) — add layers that other industries don’t face.
- Dark web value of medical records: Healthcare records sell for approximately $250 per complete record on dark web markets, compared to $5–15 for stolen credit card data. Synthetic medical identities built from compromised PHI — used for prescription fraud, insurance billing fraud, and identity theft — command premiums that motivate repeat targeting.
- Life-critical system disruption: Unlike retail or finance, healthcare cannot tolerate operational downtime. Emergency redirection, manual paper-based workflows, and surgical postponements during recovery periods create direct costs that are unique to the sector.
Cost Per Record: The $408 Benchmark
The per-record breach cost in healthcare stands at $408 — the highest of any industry globally. This figure, derived from IBM’s activity-based costing methodology, means that a breach exposing 100,000 patient records generates approximately $40.8 million in fully loaded costs when detection, escalation, notification, legal response, regulatory fines, and lost business are included.
For context:
- Government sector: ~$134 per record
- Retail sector: ~$168 per record
- Financial services: ~$201 per record
- Healthcare: $408 per record — 3× the government sector rate
Detection and Containment: The 279-Day Problem
IBM’s 2025 report identifies healthcare as the slowest industry to detect and contain breaches, with a mean lifecycle of 279 days — nearly 38 days longer than the already-concerning global average of 241 days.
This extended detection window is not accidental. It reflects:
- Fragmented IT environments combining legacy systems with modern EHR platforms
- Staff cybersecurity awareness training that lags other regulated industries
- Understaffed security operations centers at most hospitals
- Ransomware operators who deliberately maintain low-profile persistence before triggering their payload
According to Axis Intelligence’s cross-analysis of IBM 2025 data and HHS OCR enforcement records, each additional 30 days of undetected access costs healthcare organizations approximately $620,000 more in total breach costs, based on IBM’s documented relationship between breach lifecycle and financial impact. This calculation does not appear in either source independently.
Ransomware — The Defining Threat
Ransomware in 2026: More Prevalent, Differently Structured
The Verizon 2026 Data Breach Investigations Report — covering 31,000+ incidents across 145 countries from November 2024 through October 2025 — delivers the most current available picture of healthcare ransomware dynamics.
| Metric | Verizon DBIR 2025 | Verizon DBIR 2026 | Change |
|---|---|---|---|
| Ransomware in all breaches | 44% | 48% | +4pp |
| Healthcare incidents tracked | 1,710 | 1,492 | ▼ 12.8% |
| Healthcare confirmed disclosures | 1,542 | 1,438 | ▼ 6.7% |
| Victims paying ransom | 36% | 31% | ▼ 5pp |
| Median ransom payment | $115,000 | $139,875 | ▲ 21.6% |
Source: Verizon 2026 DBIR, published May 2026.
The counter-intuitive finding: Ransomware victim counts are slightly down in healthcare in 2026, but median payments are up 21.6%. Axis Intelligence’s cross-reference of DBIR 2026 and HHS OCR enforcement data suggests this reflects threat actor targeting evolution — fewer, higher-value targets being hit rather than broad spray-and-pray campaigns.
Healthcare Ransomware Attack Vectors (2026)
Per Verizon DBIR 2026 data on confirmed healthcare data disclosures:
| Initial Access Vector | % of Healthcare Breaches |
|---|---|
| Vulnerability exploitation | 20% |
| Phishing | 14% |
| Stolen credentials | 11% |
| Employee error | 11% |
| Social engineering | 7% |
| Other/unknown | 37% |
For the first time in DBIR’s 19-year history, vulnerability exploitation (20%) has overtaken stolen credentials as the leading initial access vector across all sectors, with Verizon attributing this to AI-accelerated attack tooling that compresses time-to-exploit from months to hours. Only 26% of CISA Known Exploited Vulnerabilities were fully remediated in the 2025 reporting period, with a median remediation time of 43 days — a 34% worsening from the prior year.
Patient Safety Impact: The Hidden Mortality Statistic
The most alarming dimension of healthcare ransomware is not financial — it is clinical. The 2025 Ponemon Institute/Proofpoint Cyber Insecurity in Healthcare study, based on 641 U.S. healthcare IT and security practitioners, documents the direct patient safety impact of cyberattacks:
- 32% of organizations reported increased patient mortality rates following cyberattacks (up from 26% in 2024)
- 64% of ransomware victims experienced delays in procedures or tests
- 59% reported longer patient stays
- 65% experienced increased patient transfers or facility diversions
- 49% reported complications from medical procedures attributable to attack-related disruption
- 93% of surveyed healthcare organizations experienced at least one cyberattack in the prior 12 months
A separate peer-reviewed analysis cited in healthcare literature found that in-hospital mortality increased by 33% during active ransomware incidents at affected facilities, equivalent to 42–67 preventable deaths over a five-year observation window. Mortality rates rose from approximately 3 per 100 Medicare patients to 4 per 100 under attack conditions.
These figures establish ransomware as not merely a financial or compliance problem in healthcare — it is a direct public health threat with measurable mortality consequences.
Attack Patterns — Phishing, Insider Threats, and Third-Party Risk
Phishing: Still the Most Scalable Entry Point
While vulnerability exploitation now tops Verizon’s initial access vector rankings overall, phishing remains the most heavily reported and second-costliest attack type in healthcare specifically.
Per IBM 2025 and Verizon 2026 data:
| Attack Type | % of Healthcare Breaches | Avg Cost (IBM 2025) |
|---|---|---|
| Phishing | 14–16% | $4.8M |
| Stolen credentials | 10–11% | $4.6M |
| Vulnerability exploitation | 20% | varies |
| Social engineering/BEC | 7% | $4.5M |
| Malicious insider | ~6% | $4.92M |
The Verizon 2026 DBIR introduces a new concern for healthcare: mobile-centric phishing. Voice and SMS phishing simulations showed a 40% higher click rate than email-based simulations, and healthcare’s patient-communication workflows make staff particularly susceptible to impersonation attacks targeting help desk personnel and clinical intake teams.
Insider Threats: Underreported and Expensive
Verizon 2026 DBIR data shows that 30% of healthcare data breaches involve insiders (whether malicious or negligent), compared to 17% across all industries. Healthcare’s structural characteristics — high staff turnover, broad legitimate access to PHI records, and the everyday movement of data between providers, insurers, and billing departments — make insider risk a persistent challenge.
IBM 2025 identifies malicious insider incidents as the most costly attack vector overall at $4.92 million average breach cost, though less frequent than external attacks.
Axis Intelligence cross-analysis of HHS OCR enforcement actions and Verizon 2025 DBIR insider data indicates that unauthorized PHI access by employees accounts for approximately 15–18% of small breaches (fewer than 500 individuals) reported annually — a category largely invisible in the headline statistics, which focus on large-breach portal entries.
Third-Party and Supply Chain Risk
One of the most significant structural vulnerabilities in healthcare cybersecurity is the extended vendor ecosystem. Nearly every hospital system relies on dozens of third-party business associates — billing companies, medical device vendors, EHR platform providers, cloud services — each of which represents a potential breach pathway.
| Metric | Source | Stat |
|---|---|---|
| Third-party involvement in breaches | Verizon DBIR 2026 | 48% of all confirmed breaches |
| YoY increase in third-party breaches | Verizon DBIR 2026 | +60% |
| Business associates in HHS OCR reports | HHS OCR 2025 data | 34% of healthcare breaches |
| Third-party MFA fully remediated | Verizon DBIR 2026 | Only 23% of third-party orgs |
Source: Verizon 2026 DBIR ; HHS OCR Breach Portal data.
The Change Healthcare ransomware attack — a single vendor breach — disrupted insurance claims processing for the entire U.S. healthcare system for weeks, affecting approximately 192.7 million individuals. HHS confirmed this total as of July 31, 2025. It remains the largest healthcare data breach in history by a margin of more than 2.5×.
HIPAA Enforcement — Penalties, Trends, and What’s Coming in 2026
2025 Enforcement: Volume Up, Dollar Amounts Moderated
The HHS Office for Civil Rights closed 21 HIPAA investigations with financial penalties in 2025 — the second-highest annual total ever, behind only 2020. However, total penalty collections reached only $8.33 million, significantly below historical peaks, because the majority of actions targeted single-provision violations rather than systemic noncompliance.
| Year | Enforcement Actions | Total Penalties Collected |
|---|---|---|
| 2022 | 16 | ~$5.3M |
| 2023 | 16 | ~$4.2M |
| 2024 | 22 (announced over 2 years) | ~$12.8M |
| 2025 | 21 | $8.33M |
Source: HHS OCR Annual Reports to Congress; enforcement data from HHS.gov and HHS press releases.
2025 enforcement priorities (from HHS OCR):
- 76% of 2025 enforcement actions included a penalty for risk analysis failure — the most commonly cited violation
- 20%+ included a penalty for Breach Notification Rule violations (failure to notify within 60 days)
- The $16 million Anthem settlement (2018) remains the largest single HIPAA penalty ever imposed
2026 Enforcement: What Changes
Per HHS OCR Director communications cited in official HHS newsroom releases:
- OCR has expanded its risk analysis initiative to include risk management in 2026 — organizations must now demonstrate they acted on documented risks, not merely that they identified them
- OCR commenced enforcement of Part 2 regulations (Substance Use Disorder records) as of February 16, 2026
- The proposed HIPAA Security Rule update (NPRM) would mandate encryption of all ePHI at rest and in transit, plus annual compliance audits for all covered entities
HIPAA penalty tiers (2026):
| Tier | Description | Per Violation | Annual Cap |
|---|---|---|---|
| Tier 1 | No knowledge | $137–$68,928 | $34,464 |
| Tier 2 | Reasonable cause | $1,379–$68,928 | $137,961 |
| Tier 3 | Willful neglect, corrected | $13,785–$68,928 | $275,865 |
| Tier 4 | Willful neglect, uncorrected | $68,928 | $2,067,813 |
Source: HHS HIPAA Violation Penalty Structure (amounts adjusted per annual cost-of-living provisions).
Healthcare Cybersecurity Spending — The Investment Response
The sustained breach epidemic has triggered a major investment response from healthcare organizations worldwide. The global healthcare cybersecurity market reflects this urgency.
| Market Forecast | 2025 Value | 2026 Value | CAGR |
|---|---|---|---|
| Mordor Intelligence | $35.78B | $42.31B | 18.26% |
| Research & Markets | $29.30B | $34.07B | 16.94% |
| IMARC Group | ~$24.4B | — | 14.4% |
| Consensus range | $24–36B | $34–42B | ~17% |
Source: Mordor Intelligence, May 2026 (via Globe Newswire); Research and Markets; IMARC Group.
The ROI gap: Despite this spending surge, IBM 2025 data shows that only 49% of breached organizations planned to increase security investment after their incident — down from 63% the previous year. This counterintuitive decline suggests post-breach budget fatigue rather than strategic under-investment.
Where AI is providing measurable returns:
According to IBM 2025, organizations with extensive security AI and automation integration:
- Identified and contained breaches 80 days faster than those without
- Reduced breach costs by an average of $1.9 million (34% savings)
- This benefit is documented specifically in IBM’s Cost of a Data Breach 2025 report at ibm.com/reports/data-breach
The Largest Healthcare Breaches on Record
All-Time Largest U.S. Healthcare Data Breaches
| Rank | Organization | Year | Individuals Affected | Type |
|---|---|---|---|---|
| 1 | Change Healthcare (UHG) | 2024 | 192.7 million | Ransomware |
| 2 | Anthem Inc. | 2015 | 78.8 million | Hacking |
| 3 | Premera Blue Cross | 2015 | 11.0 million | Hacking |
| 4 | Excellus BCBS | 2015 | 10.0 million | Hacking |
| 5 | Community Health Systems | 2014 | 4.5 million | Hacking |
Source: HHS OCR Breach Portal (ocrportal.hhs.gov). Change Healthcare total confirmed by HHS as of July 31, 2025.
The Change Healthcare breach deserves particular scrutiny: the attack exploited the absence of multifactor authentication on a legacy server, a basic security control that UnitedHealth Group had not applied to a system processing 15 billion transactions annually — more than one-third of all U.S. healthcare claims.
Notable 2025 Breaches
In 2025, two additional health plan mega-breaches entered the record books alongside hundreds of smaller incidents. The PIH Health ransomware attack — initiated in December 2024, with the threat actor maintaining network access from November 14 to December 23, 2024 — took until February 2026 for full individual notification to begin, a timeline that exemplifies the sector’s chronic detection latency.
Methodology
Data Collection
This report synthesizes data from the following primary source categories:
- HHS OCR Breach Portal — All breach counts, affected individual totals, and enforcement data are sourced from HHS Office for Civil Rights official records or HHS Annual Reports to Congress.
- IBM Cost of a Data Breach Report 2025 — All breach cost figures, per-record costs, detection times, and industry comparisons. IBM’s methodology: Ponemon Institute study, 600 organizations, 16 countries, activity-based costing (ABC).
- Verizon Data Breach Investigations Report 2026 — Attack vector data, ransomware trends, insider and third-party statistics. Covers 31,000+ incidents, 145 countries, November 2024–October 2025.
- Ponemon Institute/Proofpoint 2025 Cyber Insecurity in Healthcare — Patient safety impact data (mortality, procedural delays). Based on 641 U.S. healthcare IT practitioners.
- HHS Breach Notification Rule — Regulatory framework and reporting requirements.
- Mordor Intelligence / Research and Markets — Healthcare cybersecurity market sizing (used for market trajectory data only, not breach statistics).
HBRI™ Calculation Transparency
The Healthcare Breach Risk Index (HBRI™) is an original Axis Intelligence calculation. It multiplies three primary-source-derived data points (IBM cost, HHS OCR count, IBM detection time) and divides by 10,000 to produce a human-readable score. It is explicitly a severity index, not a prediction model. Limitations: (a) breach counts reflect only incidents of 500+ individuals per HHS OCR reporting rules; (b) cost and detection time figures derive from IBM’s sample of 600 organizations globally, which may not fully represent small U.S. providers; (c) 2025 breach count is preliminary and will increase as OCR processes backlogged reports from the 2025 government shutdown period.
Limitations
- HHS OCR data reflects only breaches of 500+ individuals; the full universe of healthcare breaches (including small incidents) is larger
- IBM’s study excludes breaches at organizations with fewer than approximately 500 employees in some country samples
- Verizon DBIR covers November 2024–October 2025 incidents, not a full calendar year
- Healthcare cybersecurity market size estimates vary significantly across market research firms; consensus ranges are provided where applicable
About This Dataset
Dataset title: Healthcare Data Breaches: Patient Record Security Statistics 2026
Publisher: Axis Intelligence Research Desk
Coverage: United States, 2009–Q2 2026 (primary); global secondary data
Update cadence: Quarterly (next: Q3 2026, September 2026)
License: Creative Commons Attribution 4.0 International (CC BY 4.0) — free to use with attribution
Download: https://axis-intelligence.com/wp-content/uploads/2026/06/healthcare-data-breaches-statistics-2026.csv
Citation Block (Copy-Paste Ready)
APA: Axis Intelligence Research Desk, & Chen, M. (2026, June 12). Healthcare data breaches: Patient record security statistics 2026. Axis Intelligence. https://axis-intelligence.com/healthcare-data-breach-statistics/
MLA: Axis Intelligence Research Desk and Marcus Chen. “Healthcare Data Breaches: Patient Record Security Statistics 2026.” Axis Intelligence, 12 June 2026, axis-intelligence.com/healthcare-data-breach-statistics/.
Chicago: Axis Intelligence Research Desk and Marcus Chen. “Healthcare Data Breaches: Patient Record Security Statistics 2026.” Axis Intelligence, June 12, 2026. https://axis-intelligence.com/healthcare-data-breach-statistics/.
Frequently Asked Questions
How many healthcare data breaches occurred in 2025?
As of June 2026, 772 large healthcare data breaches (affecting 500 or more individuals each) are confirmed in the HHS OCR Breach Portal for 2025, making it the worst year on record. This total is expected to increase as OCR finalizes delayed processing from the 43-day government shutdown in late 2025. The 772 figure surpasses the previous record of 746 set in 2023 by 3.49%.
What is the average cost of a healthcare data breach in 2025?
According to IBM’s Cost of a Data Breach Report 2025, the average cost of a healthcare data breach globally was $7.42 million — a decrease from $9.77 million in 2024, partly driven by faster AI-assisted containment. For U.S. breaches specifically, the average across all industries reached a record $10.22 million, reflecting higher regulatory penalties and more complex breach notification requirements.
Why does healthcare have the most expensive data breaches?
Healthcare has topped IBM’s industry breach cost rankings for 14 consecutive years for three structural reasons: (1) HIPAA regulatory penalties add compliance costs unavailable in other industries, with violations carrying fines up to $2 million per violation category; (2) medical records command $250+ per record on dark web markets, approximately 25–50× the value of credit card data, making healthcare a priority target; (3) life-critical operational disruption — unlike retail, healthcare cannot simply redirect activity when systems fail, creating unique operational costs during breach response.
What percentage of healthcare breaches involve ransomware?
Per the Verizon 2026 DBIR, 48% of all healthcare data breaches now involve ransomware — up from 44% in the 2025 DBIR. For 2025 specifically, the Sophos State of Ransomware report found that 67% of healthcare organizations worldwide experienced a ransomware attack — nearly double the 34% figure from 2021.
How many Americans have had their medical data breached?
Since HHS OCR began publishing breach data in 2009, more than 1.01 billion instances of individual PHI exposure have been recorded — representing 2.9 times the current U.S. population. This cumulative total crossed one billion in 2025, primarily because 2024 alone saw approximately 289.8 million individuals affected, dominated by the Change Healthcare attack (192.7 million individuals confirmed by HHS as of July 31, 2025).
Do healthcare data breaches affect patient safety?
Yes. The 2025 Ponemon Institute/Proofpoint Cyber Insecurity in Healthcare study found that 32% of healthcare organizations reported increased patient mortality rates following cyberattacks — up from 26% the prior year. Additionally, 64% experienced procedural or test delays, and 65% reported increased patient transfers or diversions due to attack-related disruptions.
What is the most common cause of healthcare data breaches?
For 2025–2026, vulnerability exploitation (20%) has overtaken stolen credentials (11%) as the primary attack vector in healthcare, per Verizon 2026 DBIR. Phishing accounts for 14% of entry points. This represents a structural shift: where breaches previously required successful social engineering, attackers now predominantly exploit unpatched software vulnerabilities — a vector accelerated by AI-powered attack tooling that compresses exploitation timelines from months to hours.
How long does it take to detect a healthcare data breach?
The mean time to identify and contain a healthcare data breach is 279 days — the longest of any industry and approximately 38 days longer than the global average of 241 days, per IBM Cost of a Data Breach Report 2025. This extended detection window allows threat actors to maintain persistent access, exfiltrate data, and maximize impact before remediation begins.
What are the HIPAA penalties for a data breach?
HIPAA penalties range from $137 per violation for unknowing violations to $68,928 per violation for willful neglect, with annual caps per violation category reaching $2,067,813 for the most serious tier. In 2025, HHS OCR resolved 21 HIPAA cases with financial penalties, collecting $8.33 million in total — with the 2018 Anthem settlement ($16 million) remaining the largest single HIPAA penalty imposed. In 2026, OCR expanded enforcement to cover risk management (not just risk analysis), meaning organizations must demonstrate action on identified risks.
What is the Healthcare Breach Risk Index (HBRI™)?
The HBRI™ is an original proprietary metric developed by Axis Intelligence Research Desk. It combines three independently published data points — average breach cost (IBM), annual breach count (HHS OCR), and mean detection time (IBM) — into a unified severity score. The 2025 HBRI™ score of 159.7 is 46% higher than the 2020 score of 109.2, confirming that despite the cost decrease in 2025, aggregate risk has materially worsened since the start of the decade. Full methodology is available in this article and in the downloadable dataset.
Embed Block — Cite This Research
Copy the HTML below to embed Axis Intelligence’s HBRI™ chart on your site with automatic attribution:
<div style="border:1px solid #e5e7eb;border-radius:8px;padding:16px;max-width:640px;font-family:sans-serif;">
<p style="font-size:13px;color:#6b7280;margin:0 0 8px;">SOURCE: Axis Intelligence Research</p>
<p style="font-size:22px;font-weight:700;margin:0 0 4px;">HBRI™ 2025: 159.7 / peak 227.6 (2023)</p>
<p style="font-size:14px;margin:0 0 12px;">Healthcare Breach Risk Index — cross-source severity score combining IBM cost data, HHS OCR breach frequency, and mean detection time (2020–2025)</p>
<table style="width:100%;border-collapse:collapse;font-size:13px;">
<tr style="background:#f3f4f6;"><th style="padding:6px;text-align:left;">Year</th><th>Avg Cost ($M)</th><th>Annual Breaches</th><th>HBRI™</th></tr>
<tr><td style="padding:6px;">2020</td><td>$7.13M</td><td>642</td><td>109.2</td></tr>
<tr style="background:#f9fafb;"><td style="padding:6px;">2021</td><td>$9.23M</td><td>714</td><td>189.1</td></tr>
<tr><td style="padding:6px;">2022</td><td>$10.10M</td><td>700</td><td>195.9</td></tr>
<tr style="background:#f9fafb;"><td style="padding:6px;">2023</td><td>$10.93M</td><td>746</td><td>227.6</td></tr>
<tr><td style="padding:6px;">2024</td><td>$9.77M</td><td>742</td><td>202.5</td></tr>
<tr style="background:#f9fafb;"><td style="padding:6px;font-weight:700;">2025</td><td><strong>$7.42M</strong></td><td><strong>772</strong></td><td><strong>159.7</strong></td></tr>
</table>
<p style="font-size:12px;color:#9ca3af;margin:12px 0 0;">Sources: IBM Cost of a Data Breach Reports 2020–2025; HHS OCR Breach Portal.
Full methodology: <a href="https://axis-intelligence.com/healthcare-data-breach-statistics/" style="color:#2563eb;">axis-intelligence.com</a></p>
</div>
Every embed creates a do-follow link back to this article. For researchers seeking full dataset access, citation collaboration, or data licensing inquiries, contact [email protected].
Vendors, healthcare security researchers, or institutional partners seeking to contribute data, suggest corrections, or be considered for inclusion in future Axis Intelligence healthcare cybersecurity reports should contact [email protected].