Healthcare Cyberattacks Cost More, Disrupt Patient Care, Proofpoint Survey Finds
A new survey shows U.S. health systems face rising attack volumes and higher operational costs, with AI governance gaps emerging as a critical risk.
Key points
- Operational disruption now accounts for the largest cost component of healthcare cyberattacks, averaging $1.39 million per incident.
- Ninety-seven percent of surveyed U.S. healthcare organizations reported experiencing at least one cyberattack in the past year.
- Forty-five percent of organizations have embedded AI in security or patient care, yet sixty percent lack controls for sensitive data used in AI systems.
U.S. healthcare organizations are facing a steep rise in cyberattack frequency, financial costs, and operational disruption, according to research published on Tuesday by Proofpoint and the Ponemon Institute. The study, based on a May 2026 survey of 705 IT and security practitioners, indicates that nearly all respondents experienced at least one cyberattack within the previous 12 months.
Operational disruption expenses have become the single largest cost driver for these incidents, averaging $1.39 million, up from $1.2 million in 2025. This figure includes costs stemming from system unavailability. The average total cost of the most expensive cyberattack also increased by nearly 8 percent to $4.2 million, compared to $3.9 million in the prior year.
Operational Impact and Financial Toll
The average number of attacks reported by organizations rose to 51 from 43 in 2025. Seventy-four percent of respondents said their organizations suffered disruption to patient care as a result of these incidents. Susan Biddle, director of healthcare solutions at Proofpoint, told ISMG that critical system downtime leads to delayed procedures, longer hospital stays, and interruptions in essential services.
Biddle noted that fewer organizations are paying extortion demands, even as ransomware continues to disrupt care. She emphasized that avoiding ransom payments does not necessarily avoid the consequences of an attack, such as operational paralysis. The findings suggest a shift in perspective: success in healthcare cybersecurity must be measured by the continuity of clinician work and patient care, not just data protection.
AI Adoption and Governance Gaps
Healthcare providers are adopting artificial intelligence faster than they can secure it, according to the report. Forty-five percent of organizations have embedded AI in cybersecurity or patient care operations, while another 30 percent plan to adopt it. However, sixty percent of respondents admitted their organizations lack controls governing sensitive data used in AI systems.
Only 42 percent of respondents said they use security measures specifically designed for AI. Biddle stated that this lack of visibility and governance is concerning because sensitive data and operational continuity are tied to patient outcomes. Clearwater, a privacy and security consulting firm, recently reported similar gaps in healthcare AI governance, according to the report.
Who is Affected
What to do and how to stay safe
- Hardware-backed key storage prevents attackers from extracting credentials even if they gain physical access to the device.
- Mobile device management enforces consistent security policies across diverse operating systems and hardware configurations.
- Application sandboxing limits the damage a compromised app can cause by restricting its access to other data and system resources.
Mobile device security requires a layered approach combining hardware, software, and policy controls. Enable encryption, use strong passcodes, and keep your operating system updated to protect your data.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
