New Proofpoint-Ponemon Institute report finds nearly three in four U.S. healthcare organizations experienced disruption to patient care due to cyberattacks

SUNNYVALE, Calif.– October 13, 2026 – Proofpoint, Inc., a global leader in human and agent cybersecurity, and Ponemon Institute, a top IT security research organization, today released findings from their fifth annual Cyber Insecurity in Healthcare report, revealing that cyberattacks are increasing in frequency, cost, and operational impact across U.S. healthcare organizations.

97% of organizations surveyed experienced at least one cyberattack in the past 12 months, of which 74% reported disruption to patient care as a result. The average number of attacks climbed to 51, from 43 in 2025, and the average cost of the most expensive cyberattack rose nearly 8% to $4.2 million. AI adoption is also outpacing governance, with AI agents operating without guardrails emerging as a leading cause of data loss, cited by 24% of respondents.

“Cyber resilience has become essential to healthcare resilience,” said Ryan Kalember, chief strategy officer, Proofpoint. “When a cyberattack delays a procedure, extends a hospital stay, or forces patients to another facility, cyber risk becomes patient risk. AI is now adding another dimension as people and AI systems access the same sensitive data and clinical workflows. Healthcare organizations need security built around those interactions so they can adopt AI without compromising the trust patient care depends on.”

This year’s report, based on responses from 705 IT and IT security practitioners at U.S. healthcare organizations, highlights several trends:

Operational disruption is becoming healthcare’s biggest cyber cost

• More attacks are driving higher costs and greater disruption. The average cost of the most expensive cyberattack increased from $3.9 million in 2025 to $4.2 million in 2026.
• Downtime and recovery carry the greatest financial impact. Disruption to normal healthcare operations averaged $1.39 million—the single largest cost category—followed by $1.05 million from idle time and lost productivity.

AI adoption is moving faster than governance

• AI is becoming part of healthcare operations and security. 45% of organizations have embedded AI in cybersecurity or both cybersecurity and patient care, while another 30% plan to adopt it.
• Security and governance have not kept pace. 60% lack controls governing sensitive data used in AI systems, only 42% use security measures specifically designed for AI systems, agents and generative AI, and just 32% have full visibility into employees’ use of unsanctioned AI tools.
• AI is introducing new dependencies and data risks. Supply chain risk from AI vendors (40%), data leakage through prompts (36%) and AI-generated phishing and social engineering (34%) are organizations’ leading AI-specific concerns.

Cyber disruption is reaching the bedside

• Cyberattacks are directly affecting patient care. Across the four attack types studied—cloud/account compromise, ransomware, supply chain attacks, and business email compromise (BEC) —an  average of 53% of respondents reporting care disruption cited increased complications from medical procedures, 52% cited longer patient stays, and 52% cited delays in tests or procedures.
• Supply chain attacks had the greatest impact on patient care. 90% of organizations experiencing these attacks reported care disruption, up from 87% in 2025. Ransomware was most associated with longer patient stays (70%), while BEC was most associated with delays in procedures and tests resulting in poor outcomes (68%).
• Data loss is also a patient-care risk. Organizations experienced an average of 21 data loss or exfiltration incidents involving sensitive healthcare information over two years. 54% said these incidents disrupted patient care; among that group, 56% reported increased mortality rates. Employee negligence remained the leading reported cause of data loss, while AI agents without guardrails emerged as a cause for 24%.
• Healthcare’s move to the cloud is raising the stakes of account compromise. 35% of organizations have moved clinical applications to the cloud, up from 30% in 2025, while another 44% plan to do so within the next two years. Yet cloud/account compromises — up to 20 per organization on average — disrupted patient care for 65% of respondents, a number climbing as adoption accelerates.

Ransomware payments decline, but disruption persists

• Fewer organizations are paying ransoms, and payments are falling. 31% of organizations experiencing ransomware paid, down from 33% in 2025, while the average costliest ransom payment fell from $1.2 million to $1.1 million.
• The clinical consequences remain significant. 72% of organizations experiencing ransomware reported patient-care disruption, up from 67% in 2025. Among those reporting disruption, 70% cited longer patient stays.

To download the 2026 Study on Cyber Insecurity in Healthcare: The Cost and Impact on Patient Safety and Care, please visit: https://www.proofpoint.com/us/resources/threat-reports/ponemon-healthcare-cybersecurity-report

To read our blog, please visit: https://www.proofpoint.com/us/blog/thought-leadership/cyber-insecurity-healthcare-2026-ai-adoption-accelerating-governance-needs

About Proofpoint, Inc.

Proofpoint, Inc. is a global leader in human and agent cybersecurity, securing how people, data and AI agents connect across email, cloud and collaboration tools. Proofpoint is a trusted partner to over 80 of the Fortune 100, over 14,000 large enterprises, and millions of smaller organizations in stopping threats, preventing data loss, and building resilience across people and AI workflows. Proofpoint’s collaboration, data, and AI security platform helps organizations of all sizes protect their people, defend their data, and adopt AI securely and confidently. Learn more at www.proofpoint.com.

 
Connect with Proofpoint on LinkedIn

Proofpoint is a registered trademark or tradename of Proofpoint, Inc. in the U.S. and/or other countries. All other trademarks contained herein are the property of their respective owners.