U.S. Healthcare Ransomware Surges as Providers Absorb the Largest Share of Attacks
Ransomware pressure on U.S. healthcare intensified sharply in the third quarter of 2026, with incidents and unverified claims targeting the sector rising 64% from the second quarter, according to Comparitech’s Oct. 15 assessment. The jump matters because healthcare sits at the intersection of high-value data, time-sensitive operations and thin tolerance for disruption. When systems go dark, the fallout extends beyond stolen records; scheduling, imaging, revenue cycle functions and bedside care can all be forced into contingency mode.
The U.S. accounted for 185 of the 306 healthcare ransomware incidents and claims tracked worldwide between July and September. Among those U.S. events, 26 were confirmed, including 23 involving healthcare providers. In a field where every delayed claim, inaccessible chart and interrupted workflow can ripple through clinical operations, that concentration of activity in the American market signals a sustained risk profile rather than an isolated spike.
One confirmed breach can force a hospital into paper workflows for days.
Confirmed Incidents Trail a Much Larger Wave of Unverified Claims
Comparitech’s methodology separates confirmed attacks from unverified claims. An incident is counted as confirmed when an organization publicly acknowledges ransomware involvement or reports a cyberattack consistent with a ransomware group’s claim. Claims that have not been acknowledged remain unconfirmed. That distinction keeps the data conservative, but it also leaves room for the figures to shift as additional incidents are validated or tied to earlier reporting periods.
Across the globe, healthcare ransomware incidents and claims climbed 40% quarter over quarter, from 219 in the second quarter to 306 in the third, and more than doubled from 151 in the same period in 2025. The broader ransomware environment moved as well, but not as quickly: Comparitech found a 29% quarter-over-quarter increase and a 61% year-over-year increase across all industries. Healthcare therefore outpaced the general ransomware trend, reinforcing how attractive the sector remains to threat actors who can exploit urgency, fragmented defenses and the need to restore service quickly.
Of the 306 worldwide incidents and claims, 53 were confirmed attacks and 253 were unverified. Hospitals, clinics and other direct-care providers made up 192 of those events. Forty were confirmed attacks, and 152 were unconfirmed claims. Comparitech identified 618,149 records known to have been compromised in the confirmed provider attacks, a figure that illustrates the data exposure side of the problem even when a ransom is never paid.
Direct-Care Providers Were Hit Hardest, but Vendors Also Drew Fire
The remaining 114 incidents and claims involved businesses operating in healthcare, including medical manufacturers, billing companies and technology providers. Thirteen were confirmed attacks, while 101 remained unverified. This split is clinically relevant because healthcare delivery does not stop at the hospital wall. A billing processor, device maker or software vendor can become the entry point for a cascade of downstream disruption affecting multiple organizations at once.
Healthcare technology companies experienced the steepest quarter-over-quarter rise within the business categories tracked in the report. Comparitech identified 22 incidents and claims against those companies, up 175% from eight in the previous quarter. Medical manufacturers recorded 51 incidents and claims, a 28% increase from the second quarter. The pattern points to an ecosystem-level vulnerability: attackers are not only targeting the point of care but also the digital and industrial supply chain that supports it.
In practice, this means a breach at a vendor can become a clinical event for the hospitals and practices relying on that vendor’s systems. Delayed documentation, suspended referrals, billing backlogs and equipment-related service interruptions can all emerge from a single compromise far removed from the bedside.
Large Breaches Exposed Health and Identity Data at Scale
Saber Healthcare Group was associated with the largest reported ransomware-related breach in the period, affecting 427,084 people. The organization confirmed in July that a cyberattack had encrypted some files and disrupted services. In September, it began notifying individuals about a breach involving medical information, health insurance details and Social Security numbers. Those data categories create both immediate privacy harm and long-tail identity risk, especially when health coverage and personal identifiers are exposed together.
Other major breaches identified in the report included Park Place Behavioral Healthcare, affecting 71,702 people; Hawaii Family Dental, affecting 45,853; WindRose Health Network, affecting 33,158; and Vernon & Waldrep OB-Gyn Associates, affecting 17,435. These cases span behavioral health, dental care, primary and specialty women’s health services, showing how widely the threat now cuts across the care continuum.
When a ransomware event reaches patient records, the impact is not limited to computer downtime. Clinical trust erodes, notification obligations expand, and organizations must manage the possibility that protected health information, insurance details and personal identifiers have already left the network.
Ransom Demands Stayed High Even Without Confirmed Payments
The median reported ransom demand was $300,000 for healthcare providers and $150,000 for healthcare businesses. No ransom payments were officially confirmed during the reporting period. Even so, the demand figures reveal the scale of coercion attackers believe the sector can bear. Healthcare organizations often face a brutal choice: restore operations under pressure, or refuse payment while absorbing the operational and reputational damage that follows a prolonged outage.
Claims attribution also remained active. The Gentlemen made the most claims against healthcare providers, with 18, followed by INC with 14. Qilin led claims against healthcare businesses with 15, while Chaos had the most confirmed attacks in both categories. Those names matter because ransomware activity is no longer a generic threat category; it is an ecosystem of repeat actors with recognizable patterns of pressure, extortion and public claiming behavior.
The quarter’s data show a sector under sustained assault, with confirmed breaches, unverified claims and vendor-side exposures all moving higher at once. The next inflection point will depend on whether healthcare organizations can reduce dwell time, segment critical systems and harden third-party access before the next wave arrives.