What the Data Shows for Healthcare Cybersecurity Risks

Somewhere in the U.S., a healthcare organization is disclosing a data breach right now — and probably another one tomorrow. In 2025, large healthcare data breaches (those affecting 500 or more people) were reported at a rate of roughly 2.1 per day, exposing the records of more than 138 million patients. The financial toll is just as steep: healthcare has been the single most expensive industry for data breaches for 14 consecutive years, according to IBM's Cost of a Data Breach Report.

 

 

Here's whatys a the current data sabout where the risk is coming from, why attackers keep winning, and what actually moves the needle on reducing it.

 

 

The average healthcare data breach cost $7.42 million in 2025 — down from $9.77 million the year before, but still nearly $3 million above the $4.44 million global average across all industries (IBM). That gap in cost exists for reasons specific to healthcare: protected health information (PHI) stays valuable on the dark web far longer than a credit card number, care can't simply stop while a network is contained, and a single hospital system routes data through dozens of connected vendors, devices, and legacy applications — any one of which can become the entry point.

 

 

The breach count itself tells a consistent story. Large healthcare breaches have held at a high baseline for three straight years — 749 in 2023, 738 in 2024, and 804 in 2025 (HIPAA Journal analysis of HHS OCR data). 2024 was a record year for individuals affected, at roughly 289 million, driven largely by a single vendor incident — the Change Healthcare breach — that alone exposed 192.7 million records. That's the pattern worth internalizing: one compromised vendor can now outweigh an entire year's worth of breaches combined.

 

The cause has also shifted. Hacking and other IT incidents now account for more than 80% of large healthcare breaches, while theft, loss, and improper disposal — once common causes — have become rare, occurring less than once a month. Healthcare isn't mostly losing laptops anymore. It's being actively targeted.

 

 

Ransomware continues to be the sharpest edge of that targeting. Healthcare organizations worldwide faced 410 confirmed ransomware attacks in the first half of 2026, up nearly 14% from 360 in the second half of 2025 (Becker's Hospital Review, citing Comparitech data). Notably, attacks against healthcare "business" segments — billing, practice management, and other vendors — rose 35%, far outpacing the 3% increase against direct care providers, a sign that attackers are increasingly going after the organizations that sit behind the hospital, not just the hospital itself. Median ransom demands landed between $300,000 and $310,000. And per IBM's research, paying the ransom doesn't reliably lower the cost of the incident — but involving law enforcement early does, cutting costs by close to $1 million on average.

 

 

InfoSight's Purple Team SOCaaS and Managed EDR give healthcare IT and compliance teams continuous monitoring, detection, and response — powered by AI, fueled by experts who understand what a HIPAA-regulated environment actually requires. Schedule a free security consultation to see where your organization's biggest exposure points are.

 

The Vulnerabilities Behind the Statistics

 

Three patterns show up again and again in the data:

 

Third-party and vendor risk. Practice management platforms, EHR systems, and billing vendors sit on enormous troves of PHI, and a breach at any one of them can ripple across every practice that uses it. IBM's 2025 research found roughly 15% of breaches involved a third-party or supply-chain compromise — and those took nearly nine months to detect on average, the slowest category of all.

 

A recent example: in January 2026, zHealth, a practice-management and EHR platform used by outpatient practices, discovered that an unauthorized party had accessed its network and quietly copied files months earlier. The incident ultimately triggered notifications to more than 118,000 people. It's a reminder that "who touches our patient data" is now as important a security question as "who's inside our network."

 

Credential-based attacks. Stolen or compromised credentials still open roughly one in ten breaches, and IBM found they take an average of 246 days to identify and contain — among the longest of any attack type. Phishing, meanwhile, became the single most common attack vector in 2025, responsible for 16% of all breaches.

 

Legacy systems and connected devices. Aging infrastructure and medical devices that can't easily be taken offline for patching remain a persistent soft spot, giving attackers time to move laterally once they're in.

 

What Healthcare Organizations Can Do to Reduce Exposure

 

None of this is happening in a regulatory vacuum. HHS OCR's proposed updates to the HIPAA Security Rule — with compliance currently anticipated by July 2027 — signal that requirements like mandatory multi-factor authentication, encryption, network segmentation, and regular risk analysis are moving from best practice to baseline expectation. Organizations that wait for the deadline to start will be behind it.

 

The organizations staying ahead of these risks are generally doing the same handful of things well:

 

The Bottom Line

 

The data is consistent: healthcare is targeted more, breached more expensively, and given less time to detect an intrusion than almost any other industry. None of that is reversible by hoping the next attack lands somewhere else. What is controllable is how quickly an organization can see an intrusion, contain it, and prove to regulators and patients that it was ready.

 

If you want a clearer picture of where your organization stands, request a meeting with InfoSight's team — we'll walk through your current exposure and where a healthcare-focused security program would strengthen it fastest.