Healthcare Data Breach Statistics 2026: Cost, HIPAA, and Records Exposed

The verified 2026 numbers on healthcare breach cost, records exposed, HIPAA enforcement, and ransomware, every figure traced to its primary publisher.

Healthcare data breaches cost an average of US$6.64 million in 2026, more than any other industry, and the thirteenth consecutive year healthcare has topped the list, according to the IBM Cost of a Data Breach Report 2026. That is roughly a third higher than the second-place sector, financial services at US$6.29 million, and a full US$1.65 million above the all-industry global average of US$4.99 million. Even after a 10.5% year-over-year decline from US$7.42 million in 2025, healthcare still sits alone at the top. Attackers keep coming back to the same target because a stolen medical record is worth more, and lasts longer, than a stolen card number: it fuels identity theft, insurance fraud, and prescription fraud that can run for years before anyone notices.

Three forces drive the 2026 healthcare breach picture. Volume set a record: 789 large breaches were reported to the HHS Office for Civil Rights in 2025, the most in a single year since federal reporting began. Concentration got worse: a single 2024 incident at Change Healthcare exposed 192.7 million people, the largest healthcare breach ever recorded. And the attack pattern hardened: 81% of healthcare breaches now trace to just three patterns, System Intrusion, Social Engineering, and Miscellaneous Errors, per the Verizon 2026 Data Breach Investigations Report. This reference is written for CISOs, healthcare security buyers, compliance leads, and the journalists who cite these numbers.

This post is the Stingrai research team's canonical 2026 reference for healthcare data breaches. It aggregates more than 45 figures from five primary publishers: IBM (with Ponemon Institute), the HHS Office for Civil Rights breach portal and enforcement record, the Verizon 2026 DBIR, and Sophos. Headline cost and enforcement figures come from full-year 2026 reporting, and IBM's report covers breaches from March 2025 through February 2026; breach-volume and records-exposed counts reflect full-year 2025 HHS data, the most complete available, because 2026 breach investigations are still open as of August 2026. Every figure links to its primary publisher, so any claim can be audited inline.

Key healthcare data breach statistics for 2026 (at a glance)

• Average healthcare breach cost (2026): US$6.64 million, the highest of any industry (IBM Cost of a Data Breach Report 2026).

• Years healthcare has led on cost: 13 consecutive years as the costliest industry (IBM, 2026).

• Largest healthcare breach ever: 192.7 million individuals at Change Healthcare in 2024 (HHS OCR).

• Large healthcare breaches reported in 2025: 789, a record year (HHS OCR breach portal, compiled by HIPAA Journal).

• Individuals affected in 2025: roughly 139.7 million, about 379,306 people per day (HHS OCR).

• Records breached since 2009: more than 1 billion (1,013,066,481) across 7,418 large breaches (HHS OCR).

• Share of 2025 breaches from hacking and IT incidents: more than 80% (HHS OCR).

• Healthcare incidents in the 2026 DBIR: 1,492 incidents, 1,438 confirmed data disclosures (Verizon 2026 DBIR).

• Healthcare providers that paid a ransom (2025): 36%, down from 61% in 2022 (Sophos State of Ransomware in Healthcare 2025).

• Mean healthcare ransomware recovery cost (2025): US$1.02 million, excluding any ransom, down about 60% year over year (Sophos, 2025).

• Maximum HIPAA civil penalty (2026): US$2,190,294 per identical violation, per year (HHS, Federal Register).

• Average time to identify and contain a breach (2026): 247 days, up from 2025 and reversing a five-year decline (IBM, 2026).

Key takeaways

Healthcare's cost lead is structural, not a one-year spike. Healthcare has been the most expensive industry for data breaches for 13 straight years (IBM, 2026). The 2026 average fell 10.5% to US$6.64 million, yet healthcare still outranks financial services (US$6.29 million) and everything else, because the underlying drivers, regulated data, life-safety pressure to pay, and long detection times, have not changed.

Breach volume hit a record even as the dollar cost per breach eased. 2025 produced 789 large healthcare breaches, more than any year on record, beating the prior high of 746 in 2023 (HHS OCR). More organizations are being hit more often, so the aggregate exposure keeps climbing even when the per-incident cost dips.

One vendor breach can dwarf a decade of everyone else. The 2024 Change Healthcare incident alone exposed 192.7 million people, nearly two-thirds of the US population, and made 2024 the worst year on record for individuals affected (HHS OCR). Third parties were involved in 32% of healthcare breaches in the 2026 DBIR, which is why business-associate risk now dominates board conversations.

Hacking, not lost laptops, is the story. More than 80% of 2025's large healthcare breaches were hacking or IT incidents, and network servers held the exposed data in 61.5% of cases (HHS OCR). Physical loss and theft, once the leading cause, now account for a small minority.

Regulators are pricing in the risk-analysis gap. OCR enforcement in 2025 centered on organizations that never completed a HIPAA Security Rule risk analysis, and 2026 raised the maximum civil penalty to US$2,190,294 per identical violation per year (HHS). Failing to test your environment is now the finding regulators cite most.

Methodology and sources

This reference aggregates statistics from primary research publishers only. Where a figure appears below, it was verified against the named publisher during a research pass completed on 21 August 2026. Sources and their data windows:

• IBM Cost of a Data Breach Report 2026 (research conducted by Ponemon Institute), covering 602 organizations that experienced breaches between March 2025 and February 2026, released July 2026. Used for breach cost by industry, the healthcare average, the global and US averages, the breach lifecycle, and AI-related breach figures.

• HHS Office for Civil Rights breach portal, the federal record of breaches affecting 500 or more individuals, current through mid-2026 for full-year 2025 and 2024 data. Annual roll-ups are compiled from the portal by HIPAA Journal, whose figures track the underlying OCR records. Used for breach counts, individuals affected, breach causes, and the location of breached information.

• Verizon 2026 Data Breach Investigations Report and its Healthcare Snapshot, covering incidents analyzed for the 2026 edition. Used for healthcare attack patterns, initial-access vectors, actor types, and third-party involvement.

• Sophos State of Ransomware in Healthcare 2025, a survey of 292 healthcare IT and security leaders whose organizations were hit by ransomware, fielded January to March 2025. Used for ransom payment rates, recovery costs, encryption rates, and root causes.

• HHS Office for Civil Rights enforcement record and the 2026 Federal Register penalty amounts. Used for HIPAA penalty tiers and enforcement trends.

Figures that could not be reached on at least one verification pass against a named primary source were dropped rather than estimated. Dollar figures are in US dollars as reported by the publisher. Where breach counts differ slightly between an interim and a later snapshot of the OCR portal, the most complete available figure is used and labeled by year.

How much does a healthcare data breach cost in 2026?

The average healthcare data breach cost US$6.64 million in 2026, per the IBM Cost of a Data Breach Report 2026. That figure is down 10.5% from US$7.42 million a year earlier, but healthcare still holds the top spot it has occupied for 13 consecutive years. It is the only industry whose average declined while most others rose, and it remains well clear of second-place financial services.

Healthcare's premium over the field is the number worth internalizing. At US$6.64 million, a healthcare breach costs 33% more than the all-industry global average of US$4.99 million, which itself rose 12% year over year to a record (IBM, 2026). In the United States, the average breach across all industries reached US$11.5 million, more than double the global figure and the highest of any country.

Table 1: Average total cost of a data breach by industry, 2026. Source: IBM Cost of a Data Breach Report 2026.

Figure 1: Healthcare leads every industry on breach cost for a 13th straight year. Source: IBM Cost of a Data Breach Report 2026.

Why does healthcare cost so much more? Regulated data carries notification, legal, and remediation obligations that most industries never face, patient care cannot pause during an incident, and healthcare breaches take longer to find and contain than the average. One more cost multiplier arrived in 2026: AI-enabled attacks. IBM found that one in four malicious breaches now involve AI, a 56% year-over-year jump, and those breaches run about US$1 million more expensive than non-AI incidents (IBM, 2026).

How many healthcare data breaches happen per year?

In 2025, 789 large healthcare data breaches (those affecting 500 or more individuals) were reported to the HHS Office for Civil Rights, the most in any year since mandatory federal reporting began (HHS OCR, compiled by HIPAA Journal). That beat the prior record of 746 breaches set in 2023 and continued an unbroken climb: healthcare has now seen more than 700 large breaches for four consecutive years. On an average day in 2025, 2.1 large healthcare breaches were reported.

Those 789 breaches exposed the protected health information of roughly 139.7 million individuals, or about 379,306 people every day. That total sits third on the all-time list, behind 2024 and 2023, and the 2025 count is still rising as investigations close.

Table 2: Large healthcare data breaches and individuals affected, 2021 to 2025. Source: HHS OCR breach portal, compiled by HIPAA Journal.

The breach-count trend is remarkably steady and upward: 511 large breaches in 2019, 663 in 2020, then 715, 719, 746, 779, and 789 through 2025 (HIPAA Journal). The number of individuals affected, by contrast, swings violently from year to year because a single mega-breach can move the total by a hundred million or more, which is exactly what happened in 2024.

How many patient records have been exposed?

Since federal reporting began in 2009, more than 1 billion healthcare records have been exposed in large breaches, 1,013,066,481 individuals across 7,418 reported incidents, per the HIPAA Journal analysis of HHS OCR data. The billion-record milestone was crossed during 2024, the single worst year on record.

That record year was driven by one incident. The 2024 ransomware attack on Change Healthcare, a UnitedHealth Group subsidiary that processes roughly one in three US patient records, exposed 192.7 million people, making it the largest healthcare data breach ever reported to HHS (HHS OCR). The estimate climbed over time, from an initial figure to 100 million, then 190 million, and finally 192.7 million as the investigation progressed. That one breach represented roughly two-thirds of all healthcare records exposed in 2024.

Figure 2: Individuals affected by reported healthcare breaches per year, 2021 to 2025. The 2024 spike reflects the Change Healthcare incident. Source: HHS OCR.

The Change Healthcare case is also the clearest illustration of concentration risk in healthcare: the sector's data is pooled inside a small number of clearinghouses, billing platforms, and electronic health record vendors, so a single upstream compromise can expose more records than years of clinic-level incidents combined.

Why is healthcare the most breached industry?

Healthcare is the most breached and most costly industry for a few structural reasons, and the 2026 data quantifies each one.

The data is uniquely valuable. A medical record bundles identity, insurance, financial, and clinical detail in one place, which is why attackers monetize it through identity theft, insurance fraud, and prescription fraud long after a stolen card would have been canceled. That durability is what keeps healthcare at the top of the target list year after year.

The attack surface is large and interconnected. The Verizon 2026 DBIR analyzed 1,492 healthcare incidents, including 1,438 confirmed data disclosures. System Intrusion, largely ransomware-driven, is the top attack pattern, and together with Social Engineering and Miscellaneous Errors it accounts for 81% of healthcare breaches. Internal actors were involved in 19% of breaches, and third parties in 32%, a reminder that business associates and supply-chain vendors are now a primary exposure route.

Attackers get in the same handful of ways. In healthcare breaches, the leading initial-access vectors are vulnerability exploitation (20%), phishing (14%), stolen credentials (11%), and employee error (11%) (Verizon 2026 DBIR). Across all industries the 2026 DBIR found that vulnerability exploitation, at 31%, has overtaken stolen credentials as the single most common way in, which puts a premium on knowing which of your systems are actually exploitable.

Breaches take longer to catch. The average breach in 2026 took 247 days to identify and contain, up from the prior year and reversing five years of gradual improvement (IBM, 2026). In healthcare, where legacy systems and clinical uptime requirements slow detection and response, long dwell times translate directly into more records exposed and higher cost.

What causes healthcare data breaches?

Hacking and IT incidents caused more than 80% of 2025's large healthcare breaches, per HHS OCR data. That is a complete inversion of the picture a decade ago, when lost or stolen devices led the category. Unauthorized access or disclosure, theft, and loss now make up the remainder, and improper disposal has become vanishingly rare.

Where the data physically sits when it is breached tells the same story. Network servers, the systems ransomware groups target, held the exposed information in 61.5% of 2025 breaches, followed by email at 24.9%.

Table 3: Location of breached protected health information, 2025. Source: HHS OCR breach portal, HIPAA Journal analysis.

Figure 3: Network servers and email accounted for more than 86% of breached healthcare data in 2025. Source: HHS OCR.

The type of organization breached matters too. In 2025, healthcare providers accounted for 57.5% of breaches, business associates for 35.8%, and health plans for 6.5% (HIPAA Journal analysis of HHS OCR data). The business-associate share is the one to watch: it means more than a third of breaches now originate with a vendor rather than the covered entity that ultimately has to notify patients.

How bad is healthcare ransomware in 2026?

Ransomware remains the dominant serious threat to healthcare, but the economics shifted sharply in the defenders' favor. Only 36% of healthcare providers paid the ransom in 2025, down from 61% in 2022, placing healthcare among the least likely sectors to pay (Sophos State of Ransomware in Healthcare 2025). The mean recovery cost, excluding any ransom, fell to US$1.02 million, roughly 60% lower year over year, as more organizations restored from backups. In Sophos's survey, 51% recovered data from backups.

Attack mechanics are shifting as well. Data was encrypted in 34% of healthcare ransomware attacks, while extortion-only attacks, where data is stolen and threatened rather than encrypted, tripled to 12%, the highest rate in the survey (Sophos, 2025). The most common technical root cause was exploited vulnerabilities at 33%, ahead of compromised credentials and malicious email. Sophos respondents flagged staffing capacity and known-but-unaddressed security gaps as their biggest organizational weaknesses.

The macro trend confirms the survey: the Verizon 2026 DBIR found ransomware present in 48% of all breaches, and it is the engine behind healthcare's top attack pattern, System Intrusion. Fewer victims paying, combined with faster backup-based recovery, is the clearest sign that healthcare's ransomware resilience is improving even as attack volume stays high.

What is the HIPAA penalty for a data breach?

HIPAA civil monetary penalties in 2026 range from US$145 to US$2,190,294 per violation, set in four tiers by the entity's level of culpability, and adjusted for inflation effective 28 January 2026 (HHS, via HIPAA Journal). The annual cap for all identical violations of a single provision reached US$2,190,294, up from US$2,134,831 the year before.

Table 4: HIPAA civil monetary penalty tiers, 2026 inflation-adjusted amounts. Source: HHS, Federal Register, via HIPAA Journal.

Penalties are only part of the enforcement picture, and the pattern of recent settlements is instructive. Through 2024, OCR closed 22 HIPAA enforcement actions with settlements or civil monetary penalties, and 2025 was a near-record year for penalties (HIPAA Journal). The through-line in 2025 was the HHS Risk Analysis Initiative: a large share of multimillion-dollar settlements stemmed from organizations that had never completed an accurate, thorough HIPAA Security Rule risk analysis, and nearly every corrective action plan now requires one. In plain terms, regulators are penalizing the failure to identify and test risk, not only the breach itself.

How long does it take to detect a healthcare data breach?

The average organization took 247 days to identify and contain a breach in 2026, a figure that rose year over year and reversed five straight years of improvement, per IBM. Healthcare tends to sit above that average because legacy clinical systems, flat networks, and the need to keep care running slow both detection and response. Every additional week a breach goes undetected means more records exposed and a higher final cost, which is why IBM consistently finds that breaches contained faster cost dramatically less.

The lever that most reduces dwell time is testing what attackers would actually reach. IBM's 2026 data shows that organizations using AI and automation in security operations cut breach costs by nearly US$2 million on average, yet only 37% of breached organizations encrypt sensitive data both at rest and in transit (IBM, 2026). The gap between the controls organizations have and the controls they have validated under attack is where healthcare breaches live.

What this means for your security program

The 2026 data points healthcare security teams at a short, specific list of priorities. Vulnerability exploitation is now the leading way into healthcare environments, dwell times are rising again, and OCR is penalizing organizations that cannot show they identified and tested their risk. The common thread is validation: knowing, before an attacker does, which of your systems, applications, and vendor integrations are actually exploitable.

That is where offensive testing earns its place. Penetration testing produces the technical-evaluation evidence that supports a HIPAA Security Rule risk analysis, and the same evidence supports SOC 2 and PCI DSS programs that healthcare organizations increasingly carry alongside HIPAA. For teams standing up AI-enabled clinical tools, scoping those systems correctly matters as much as testing them, which is the focus of our guide to healthcare AI penetration testing and clinical LLM scoping.

Stingrai is a CREST-accredited penetration testing provider, based in Toronto with a London office, that delivers both annual and continuous testing so healthcare teams can validate a new release or maintain year-round coverage of a changing attack surface. If you want to map these statistics to your own environment, get a quote or compare approaches in our penetration testing cost guide for 2026. For the cross-industry picture, see our companion data breach statistics 2026 reference and the ransomware payout statistics 2026 post.

Frequently asked questions

How much does a healthcare data breach cost in 2026?

A healthcare data breach cost an average of US$6.64 million in 2026, the highest of any industry and the 13th consecutive year healthcare has topped the list, per the IBM Cost of a Data Breach Report 2026. That is above second-place financial services at US$6.29 million and well above the all-industry global average of US$4.99 million. The healthcare figure fell 10.5% from US$7.42 million in 2025 but still leads every other sector.

How many healthcare data breaches happen per year?

In 2025, 789 large healthcare data breaches (those affecting 500 or more individuals) were reported to the HHS Office for Civil Rights, a record, exposing roughly 139.7 million people, per HHS OCR data. That is an average of 2.1 large breaches and about 379,306 affected individuals per day. Healthcare has recorded more than 700 large breaches for four years running.

Why is healthcare the most breached industry?

Healthcare is the most breached and most costly industry because its data is uniquely valuable, its attack surface is large and interconnected, and its breaches take longer to detect. A medical record supports identity, insurance, and prescription fraud for years, and 32% of healthcare breaches now involve third parties such as business associates, per the Verizon 2026 DBIR. Long detection times, an average of 247 days across all industries in 2026, compound the exposure (IBM).

What is the HIPAA penalty for a data breach?

HIPAA civil monetary penalties in 2026 range from US$145 to US$2,190,294 per violation, set in four culpability tiers, with an annual cap of US$2,190,294 for all identical violations of one provision, per HHS figures effective 28 January 2026. Recent OCR settlements have centered on the failure to complete a HIPAA Security Rule risk analysis, and corrective action plans now routinely require one.

What was the largest healthcare data breach ever?

The largest healthcare data breach ever recorded is the 2024 ransomware attack on Change Healthcare, a UnitedHealth Group subsidiary, which exposed the protected health information of 192.7 million individuals, nearly two-thirds of the US population, per HHS OCR. The estimate rose over time as the investigation progressed, and the single incident accounted for roughly two-thirds of all healthcare records exposed in 2024.

How many patient records have been exposed in healthcare breaches?

Since federal breach reporting began in 2009, more than 1 billion healthcare records have been exposed in large breaches, precisely 1,013,066,481 individuals across 7,418 incidents, per the HIPAA Journal analysis of HHS OCR data. The billion-record threshold was crossed during 2024, when 289.2 million individuals were affected, the worst year on record.

What is the most common cause of healthcare data breaches?

Hacking and IT incidents cause more than 80% of large healthcare data breaches, per HHS OCR data, and network servers held the exposed data in 61.5% of 2025 breaches. In the Verizon 2026 DBIR, the top initial-access vectors for healthcare breaches were vulnerability exploitation (20%), phishing (14%), stolen credentials (11%), and employee error (11%).

How common is ransomware in healthcare, and does it still pay off for attackers?

Ransomware drives healthcare's top attack pattern, but fewer victims are paying. Only 36% of healthcare providers paid a ransom in 2025, down from 61% in 2022, and the mean recovery cost excluding ransom fell to US$1.02 million as 51% restored from backups, per Sophos. Data was encrypted in 34% of attacks, while extortion-only attacks tripled to 12%.

How long does it take to detect a healthcare data breach?

The average organization took 247 days to identify and contain a breach in 2026, a rise year over year that reversed five years of improvement, per IBM. Healthcare typically runs above that average because legacy clinical systems and uptime requirements slow both detection and containment, and longer dwell times drive higher costs.

Where can I find the latest healthcare data breach data?

Primary sources include the HHS Office for Civil Rights breach portal for breaches affecting 500 or more individuals, the IBM Cost of a Data Breach Report for cost benchmarks, the Verizon DBIR for attack patterns, and Sophos for healthcare ransomware. This page aggregates the current figures from each, updated for 2026.

References

1. IBM. Cost of a Data Breach Report 2026. July 2026. https://www.ibm.com/reports/data-breach. Research conducted by Ponemon Institute across 602 organizations breached between March 2025 and February 2026; source for breach cost by industry, the healthcare average, global and US averages, breach lifecycle, and AI-related figures.

2. IBM Newsroom. IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average. 29 July 2026. https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average. Official press release for the 2026 report; source for the US$4.99 million global average and AI-enabled breach figures.

3. HHS Office for Civil Rights. Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information. https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf. The federal record of healthcare breaches affecting 500 or more individuals; source for breach counts, individuals affected, breach type, and location of breached information.

4. HHS Office for Civil Rights. Change Healthcare Cybersecurity Incident Frequently Asked Questions. https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html. Source for the Change Healthcare incident, the largest healthcare breach ever reported to HHS at 192.7 million individuals.

5. Verizon. 2026 Data Breach Investigations Report and 2026 DBIR Healthcare Snapshot. https://www.verizon.com/business/resources/reports/dbir/. Source for healthcare attack patterns, initial-access vectors, actor types, and third-party involvement.

6. Sophos. The State of Ransomware in Healthcare 2025. https://www.sophos.com/en-us/blog/the-state-of-ransomware-in-healthcare-2025. Survey of 292 healthcare IT and security leaders hit by ransomware; source for payment rates, recovery costs, encryption rates, and root causes.

7. HHS Office for Civil Rights. HIPAA Enforcement and Resolution Agreements. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/index.html. Source for HIPAA enforcement trends and the Risk Analysis Initiative.

8. HIPAA Journal. Healthcare Data Breach Statistics, Updated for 2026. https://www.hipaajournal.com/healthcare-data-breach-statistics/. Compilation of HHS OCR breach portal data; source for year-by-year breach counts, individuals affected, cumulative totals, and cause and location breakdowns.

9. HIPAA Journal. What are the Penalties for HIPAA Violations? 2026 Update. https://www.hipaajournal.com/what-are-the-penalties-for-hipaa-violations-7096/. Source for the 2026 inflation-adjusted HIPAA civil monetary penalty tiers.

10. Becker's Hospital Review. Healthcare data breaches cost $6.64M on average: Report. https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/healthcare-data-breaches-cost-6-64m-on-average-report/. Independent confirmation of the IBM 2026 healthcare figure and second-place ranking.

11. Help Net Security. Data breach cost 2026 averaged $4.99 million, AI attacks ran higher. 30 July 2026. https://www.helpnetsecurity.com/2026/07/30/ibm-cost-of-a-data-breach-2026/. Independent confirmation of the IBM 2026 global average, the 247-day breach lifecycle, and the thirteenth-consecutive-year claim.