2026 HEALTHCARE CYBERSECURITY RESEARCH

Healthcare Data Security & Cyberattack Trends 2026

Explore findings from the fifth annual Ponemon Institute healthcare study on data security and cyberthreats, including how cyberattacks are disrupting patient care and where AI governance and sensitive data controls are falling behind. 

Download the report Explore healthcare cybersecurity solutions
Healthcare professional using a tablet to access patient information
Key Findings
Patient Care
Cost
AI
Data Loss
Cloud
Supply Chain

AT A GLANCE

Key Findings

74

%

report patient care disruption

average across four attack types, up from 72%

$

4.2

M

average cost of the costliest attack

up from $3.9M in 2025

90

%

of successful supply chain attacks disrupted care

up from 70% in 2022

60

%

lack controls for sensitive data in AI

only 32% fully see unsanctioned AI tools

Bar chart comparing four cyberattack types

Patient Care Impact

Cyberattacks are becoming patient care events 

Cyberattacks on healthcare organizations are inevitable. According to survey respondents, 97% of organizations experienced one or more attacks in the past 12 months—51 on average, up from 43 in 2025.

The study examined four attack types and their effects on clinical operations. Across them, an average of 74% of affected organizations reported disruption to patient care. Supply chain attacks were the most disruptive, impacting care for 90% of affected organizations.

Attack type % of organizations affected% of affected organizations reporting care impact
Supply chain compromise50%90%
Ransomware attack63%72%
Business email compromise (BEC), spoofing, and impersonation 65%69%
Cloud/account compromise76%65%

What does the study show about ransomware in healthcare? 

Nearly two-thirds (63%) of survey respondents reported experiencing ransomware attacks in their healthcare environments, with an average cost of $1.1 million for the costliest attacks. Of those, 72% reported disruption to patient care. When patient care impacts were cited, 70% of respondents reported longer patient stays as an impact. 

Look closer at the impacts on patient care. Learn how each type of attack is affecting patient outcomes, including procedure complications, delays, length of stay, transfers and diversions, and more. 

Get the full report
Bar chart of average cost of the most expensive healthcare cyberattack by category, 2025 vs. 2026.

COST OF ATTACKS

Healthcare cyberattack costs are trending up again in 2026 

Healthcare organizations estimated their most expensive cyberattack at $4.2 million on average, up from $3.9 million in 2025, moving costs back toward the higher levels of earlier years.

Disruption is the biggest driver. Operational disruption was the largest cost category at $1.39 million, followed by $1.05 million in idle time and lost productivity. Both categories rose from 2025. For healthcare leaders, these trends point to the growing importance of cyber resilience in maintaining and restoring clinical operations.

How much can cyberattacks cost a healthcare organization?

The study found the cost of the most expensive attack organizations faced averaged $4,204,600 according to respondent estimates, with disruption to normal healthcare operations the largest individual cost category. 

AI SECURITY GAP

AI security and healthcare data protection: AI adoption is outpacing AI governance 

Healthcare organizations are adopting AI more quickly than they are securing it. Among respondents, 45% have embedded AI in cybersecurity or in both cybersecurity and patient care, and another 30% plan to adopt it in the future.

Controls have not kept up with the rate of adoption. Most organizations (60%) lack controls governing sensitive data used in AI systems. Only 42% use security measures built for AI usage, and even fewer have full visibility into shadow AI tools.

Among respondents' biggest AI-specific worries, the AI supply chain came first, with 40% pointing to risk from AI vendors. Data leaking through prompts and AI-generated phishing and social engineering followed close behind. Fourth was malicious or biased outputs affecting care decisions, a risk that reaches past data and into patient well-being.

45 %

have embedded AI in cybersecurity

60 %

lack controls for sensitive data in AI

42 %

use security built for AI

32 %

have full visibility into unsanctioned AI

What are the biggest AI security risks in healthcare? 

When asked about their top three AI-specific concerns, 40% of survey respondents cited supply chain risk from AI vendors. The next most-cited were data leakage through prompts (36%), AI-generated phishing and social engineering (34%), and malicious or biased outputs affecting care decisions (32%). See which AI security controls peers have in place, which are still uncommon, and how many organizations are reporting widespread ungoverned generative AI use. 

Download the full report
Ranked bar chart of leading causes of healthcare data loss.

DATA LOSS AND INSIDER RISK

Healthcare data security: Data loss and AI risk 

Nearly all organizations (97%) reported at least two data loss or exfiltration incidents involving sensitive health information in the past two years, with 21 incidents on average, up from 18 in last year's study. Over half (54%) say the incidents disrupted patient care operations, and of this group, more than half reported increased mortality rates.

Employees are still the most common root cause of data loss, but AI agents are joining them. This year, 24% of respondents named AI agents operating without guardrails as a cause of data loss. These and many of the other top causes have a key thing in common: they have legitimate access. For security teams, this makes data loss a more complicated problem than simply keeping attackers out.

24% of respondents named AI agents operating without guardrails as a cause of data loss in the last two years. 

How common are healthcare data security incidents? 

Ninety-seven percent of healthcare organizations faced two or more data loss or exfiltration during the two years prior to May 2026, according to survey respondents. The average number of incidents per organization was 21 in the 2026 study, compared with 18 in the 2025 study. 

Cloud & Account Risk

Account compromise is following healthcare into the cloud 

76 %

experienced cloud or account compromise

58 %

reported attacks on Teams, Slack, and Office tools

For the fifth straight year, cloud and account compromises were the most frequent attacks in the study, affecting 76% of organizations (up from 72% in 2025). Sixty-five percent of those organizations say the compromises disrupted patient care. Affected organizations faced an average of 20 compromises over two years, more than four times the average for any other attack type.

Risk exposure is growing as clinical systems move to the cloud. Already, 35% of respondents say their organizations have moved clinical applications, and another 44% plan to. The compromises land in everyday collaboration accounts, from messaging and video conferencing to email and shared workspaces. See the tools attackers hit most in the full report.

Line chart of patient care disruption after a supply chain attack, rising every year: 70% in 2022, 77% in 2023, 82% in 2024, 87% in 2025 and 90% in 2026.

DATA LOSS AND INSIDER RISK

Supply chain attacks pose a greater risk to patient care every year 

Supply chain attacks have disrupted patient care at a higher rate each year the Study on Cyber Insecurity in Healthcare has been conducted. 

Did the supply chain attacks result in a disruption in patient care operations? ("Yes" responses)
20222023202420252026
70%77%82%87%90%
Among organizations that experienced a supply chain attack. Source: Ponemon Institute and Proofpoint, 2026 Study on Cyber Insecurity in Healthcare.

DOWNLOAD THE FULL REPORT

Strengthen data security and cyber resilience

Five years of trends, patient care outcomes by attack type, and AI control benchmarks. 

To protect patient care in the coming years, healthcare organizations will need to combine cyber resilience, identity security, human risk management, supply chain security, and AI governance.

The unabridged report shows which risks are accelerating, which are slowing down, and where concern is drifting away from the threats organizations actually face.

About this study

The 2026 Study on Cyber Insecurity in Healthcare is the fifth annual report from Ponemon Institute, sponsored by Proofpoint. Ponemon conducted the survey in May 2026, gathering responses from 705 IT and IT security practitioners in healthcare organizations who participate in cybersecurity strategy, such as setting priorities, managing budgets, or selecting vendors.

Respondents come from healthcare providers, insurers and payers, and life sciences organizations. Most (63%) hold supervisory roles or above, and 62% work at organizations with more than 1,000 employees.