Nearly Three in Four US Healthcare Groups Report Cyberattack Harm to Patient Care

More attacks, higher costs

The report is based on responses from 705 IT and IT security practitioners at U.S. healthcare organizations. It finds that the average number of attacks per organization climbed to 51, from 43 in 2025. The average cost of the most expensive cyberattack rose nearly 8%, from $3.9 million in 2025 to $4.2 million in 2026.

Operational disruption is the biggest cost driver. Disruption to normal healthcare operations averaged $1.39 million, the single largest cost category, followed by $1.05 million from idle time and lost productivity.

Effects reach patients

The study looked at four attack types: cloud or account compromise, ransomware, supply chain attacks, and business email compromise (BEC). Among respondents who reported care disruption, an average of 53% cited increased complications from medical procedures, 52% cited longer patient stays, and 52% cited delays in tests or procedures.

• Supply chain attacks had the greatest impact: 90% of organizations hit by them reported care disruption, up from 87% in 2025.
• Ransomware was most associated with longer patient stays (70%).
• BEC was most associated with delays in procedures and tests resulting in poor outcomes (68%).

Data loss is also a patient-care risk. Organizations reported an average of 21 data loss or exfiltration incidents involving sensitive healthcare information over two years. Of these, 54% said the incidents disrupted patient care, and among that group 56% reported increased mortality rates. Employee negligence remained the leading cause, while AI agents without guardrails were cited by 24%.

Cloud migration adds pressure. 35% of organizations have moved clinical applications to the cloud, up from 30% in 2025, and another 44% plan to within two years. Cloud or account compromises, up to 20 per organization on average, disrupted patient care for 65% of respondents.

Ransomware payments fall, disruption does not

Fewer organizations are paying ransoms. 31% of those hit by ransomware paid, down from 33% in 2025, and the average costliest ransom payment fell from $1.2 million to $1.1 million. Yet 72% of organizations experiencing ransomware reported patient-care disruption, up from 67% a year earlier.

AI adoption outpaces governance

45% of organizations have embedded AI in cybersecurity or in both cybersecurity and patient care, and another 30% plan to adopt it. Controls have not kept up. According to the report, 60% lack controls governing sensitive data used in AI systems, only 42% use security measures designed specifically for AI systems, agents and generative AI, and just 32% have full visibility into employees' use of unsanctioned AI tools.

The leading AI-specific concerns are supply chain risk from AI vendors (40%), data leakage through prompts (36%) and AI-generated phishing and social engineering (34%).

Ryan Kalember, chief strategy officer at Proofpoint, said: "Cyber resilience has become essential to healthcare resilience." He added that healthcare organizations need security built around the interactions between people and AI systems so they can adopt AI without compromising patient trust.

What it means for healthcare providers

The findings point to a sector where cyber incidents translate directly into clinical consequences, and where falling ransom payments have not reduced the harm. For healthcare IT leaders, the data suggests that governance of AI tools and sensitive data, along with protection of cloud accounts and supply chains, is lagging behind adoption. The full study is available from Proofpoint.