Healthcare Cyberattacks Hit Nearly Every Surveyed Organization as Care Disruptions Mount
Cyber risk has become a bedside problem, not just an information technology problem. In a new 2026 healthcare cybersecurity report from Proofpoint Inc., 97% of surveyed healthcare organizations said they experienced at least one cyberattack over the past 12 months, and 74% of those reporting an attack said patient care was disrupted afterward.
The numbers describe a sector under sustained pressure. When attacks touch scheduling systems, clinical communications, billing infrastructure, or device-linked workflows, the damage moves quickly from the server room to the exam room. In healthcare, even brief outages can delay prescriptions, slow admissions, interrupt lab access, and force clinicians to work without the data they rely on for safe decisions.
The report drew on responses from 705 IT and IT security practitioners across U.S. healthcare organizations. Those respondents described a threat environment that is both more frequent and more costly than it was a year earlier. The average number of attacks rose from 43 in 2025 to 51 in 2026, while the average cost of the most expensive attack climbed 8% to $4.2 million.
One sentence captures the operational reality: the attack burden keeps climbing while defenses remain uneven.
Patient Care Delays Became the Most Visible Cost of Attack Volume
A cyber incident in healthcare rarely ends with locked files alone. The clinical fallout can cascade through triage, medication reconciliation, referral routing, and discharge planning, especially when organizations depend on interconnected platforms that were never fully designed with modern threat volume in mind. As attacks multiply, the odds increase that one of them will land at a moment when staffing is thin or clinical demand is high.
The report’s finding that 74% of organizations with at least one attack experienced subsequent disruptions to patient care deserves close attention. It signals that the major harm is not limited to abstract loss estimates or IT remediation bills. It means the attack penetrated enough of the care environment to alter workflow, slow access, or force temporary workarounds that carry their own safety risks.
For hospitals and health systems, those workarounds often create secondary vulnerability. Manual charting, paper fallback processes, and improvised communication channels can preserve continuity in the short term, but they also raise the risk of transcription errors, missed messages, and delayed follow-up. In a setting where minutes matter, every workaround has a clinical cost.
AI Adoption Is Advancing Faster Than Governance
The report places a separate warning light on artificial intelligence. Analysts noted that AI adoption in healthcare is moving faster than governance, and the survey data make that gap visible. Sixty percent of respondents said they lack controls governing sensitive data, only 42% reported using security measures specifically for AI, and just 32% said they have full visibility into employee use of unsanctioned tools.
That combination creates a familiar but escalating danger: useful technology enters the organization faster than the rules for handling it. In healthcare, where sensitive clinical and personal data flow across messaging systems, documentation tools, cloud services, and now AI applications, loose governance can widen the attack surface in ways many institutions have not fully mapped. If staff members use unapproved tools to draft notes, summarize records, or accelerate routine work, data may leave controlled environments without the oversight needed to protect it.
The risk is not theoretical. Healthcare data are especially valuable because they are richly identifying and hard to replace. A breach can expose diagnoses, medications, dates of service, insurance details, and longitudinal histories. In the wrong hands, that information can fuel fraud, identity theft, extortion, and further intrusion attempts.
Security Controls Still Trail the Threat Environment
The report suggests that many organizations are still building defenses one layer at a time while the adversary keeps changing tactics. A rise from 43 attacks to 51 in a single year is more than a statistical uptick. It reflects pressure from phishing, credential theft, ransomware, and other methods that exploit human behavior as much as technical gaps.
Healthcare remains attractive to attackers because clinical operations cannot tolerate long interruptions. The sector’s dependence on uninterrupted access to records, scheduling, imaging, revenue cycle systems, and communications means attackers can sometimes extract leverage simply by threatening delay. That leverage is amplified when organizations lack full visibility into unsanctioned tools or have not embedded AI-specific safeguards into broader security governance.
The cost data reinforce the same point. An average price tag of $4.2 million for the most expensive attack in the prior year places the issue squarely in enterprise-risk territory. Those losses are not confined to recovery expenses. They can include containment, forensic review, legal work, regulatory response, downtime, and the resource drain that follows after the immediate crisis has passed.
The Practical Burden Falls on Clinicians as Much as Security Teams
When cyber defenses fail, clinicians often absorb the downstream consequences first. They wait longer for access to charts, reconcile medication lists from incomplete records, and manage patients through delayed workflows that were supposed to be automated. The report’s findings imply that the most resilient cybersecurity strategy is not just a technical stack but an operational one: hospitals need incident response plans that preserve core clinical functions when digital systems falter.
AI adds another layer of urgency. Healthcare organizations want the efficiency gains, but the same tools can magnify privacy and security failures if permissions, monitoring, and approved-use policies lag behind deployment. Sensitive data controls, AI-specific safeguards, and visibility into unsanctioned use are no longer optional safeguards; they are the minimum infrastructure required to keep automation from becoming a new liability.
For health systems already stretched by staffing shortages and budget constraints, the challenge is sharper still. Security spending now has a direct relationship to patient safety. A breach may begin as an IT event, but its consequences are experienced in delayed care, interrupted workflows, and the quiet erosion of trust that follows repeated disruptions. The report stops short of offering a single remedy, and none exists. What it does make plain is that healthcare organizations face a threat environment that is growing more frequent, more expensive, and less forgiving each year.