U.S. Healthcare Groups Face Record Cyberattack Costs and Patient Care Disruption

Proofpoint and the Ponemon Institute released their fifth annual Cyber Insecurity in Healthcare report on October 13, 2026. The study reveals that cyberattacks are increasing in frequency and operational impact across U.S. healthcare organizations, with nearly three in four reporting disruption to patient care.

The survey of 705 IT and security practitioners found that 97% of organizations faced at least one attack in the past year. Of those, 74% reported that these incidents disrupted patient care. The average number of attacks per organization climbed to 51 in 2026, up from 43 in 2025, indicating a sustained upward trend in threat volume.

Financial and Operational Impact

The financial toll of these incidents is rising alongside their frequency. The average cost of the most expensive cyberattack increased by nearly 8% to $4.2 million in 2026, compared to $3.9 million the previous year. Disruption to normal healthcare operations represented the single largest cost category, averaging $1.39 million per incident. Idle time and lost productivity followed as the second largest expense, averaging $1.05 million.

Operational downtime is becoming the primary driver of healthcare’s cyber costs. The report highlights that when attacks delay procedures or force patients to other facilities, cyber risk directly translates into patient risk. Ryan Kalember, chief strategy officer at Proofpoint, noted that security must be built around interactions between people and AI systems to maintain trust.

AI Governance and Data Risks

Artificial intelligence adoption is outpacing security governance within the healthcare sector. Forty-five percent of organizations have embedded AI in cybersecurity or patient care workflows, while another 30% plan to adopt it. However, 60% of respondents lack controls governing sensitive data used in AI systems. Only 42% use security measures specifically designed for AI agents and generative AI tools.

AI agents operating without guardrails emerged as a leading cause of data loss, cited by 24% of respondents. Supply chain risk from AI vendors was the top AI-specific concern at 40%, followed by data leakage through prompts at 36%. AI-generated phishing and social engineering accounted for 34% of AI-related worries among the surveyed organizations.

Patient Care Disruption

Cyberattacks are directly affecting clinical outcomes across multiple attack types. The study examined cloud account compromise, ransomware, supply chain attacks, and business email compromise. On average, 53% of respondents reporting care disruption cited increased complications from medical procedures. Longer patient stays and delays in tests or procedures were each cited by 52% of affected organizations.

Supply chain attacks had the greatest impact on patient care, with 90% of organizations experiencing these attacks reporting disruption, up from 87% in 2025. Ransomware was most associated with longer patient stays at 70%, while business email compromise was most linked to procedural delays resulting in poor outcomes at 68%.

Data loss incidents also pose significant risks. Organizations experienced an average of 21 data loss or exfiltration incidents involving sensitive healthcare information over two years. Fifty-four percent said these incidents disrupted patient care, and among that group, 56% reported increased mortality rates.

What should you do?

Background: AI-generated phishing

AI tools allow attackers to craft personalized, grammatically perfect phishing emails at scale. Because the text is flawless, you cannot rely on spelling errors as a warning sign. Instead, verify the sender’s identity through a separate channel and scrutinize the context of the request for logical inconsistencies.

Read the full guide: AI-Generated Phishing: How to Spot Synthetic Social Engineering

What to do and how to stay safe: Proofpoint

• Audit all AI tools and agents currently in use to ensure they have specific security controls and guardrails for sensitive data.
• Review supply chain vendors for AI services and assess their security posture to mitigate third-party risks.
• Monitor for signs of operational disruption such as delayed procedures or extended patient stays that may indicate an ongoing attack.
• Implement visibility tools to track employee use of unsanctioned AI applications and prevent data leakage through prompts.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many healthcare organizations experienced cyberattacks in the past year?

97% of the 705 U.S. healthcare organizations surveyed by Proofpoint and Ponemon Institute experienced at least one cyberattack in the past 12 months.

What is the average cost of the most expensive cyberattack in 2026?

The average cost of the most expensive cyberattack rose to $4.2 million in 2026, an increase from $3.9 million in 2025.

Which type of attack had the greatest impact on patient care?

Supply chain attacks had the greatest impact, with 90% of organizations experiencing these attacks reporting disruption to patient care.