Healthcare Data Breach Statistics: Records Exposed, Costs, and Trends

Healthcare has been the most expensive industry in the world to breach for 13 straight years, and the numbers behind that record are staggering: more than 700 large breaches reported every year, a single 2024 attack that exposed 190 million people, and an average breach cost of $7.42 million. This roundup pulls together the healthcare data breach statistics that matter, from records exposed and breach costs to how attackers get in and what a breach does to patient care, with every figure traced to a primary source.

What’s in This Guide

1How Many Breaches and How Many Records

The clearest window into healthcare breaches is the federal government’s own. Under the HIPAA Breach Notification Rule, any breach affecting 500 or more individuals must be reported to the HHS Office for Civil Rights, which publishes every one on a public portal often called the “Wall of Shame.” That portal turns healthcare into one of the few industries with a near-complete, primary-source record of its breaches. What it shows is a sector under relentless, sustained pressure.

Two numbers in that list explain the whole story of healthcare breach data. The breach count barely moved between 2024 and 2025, from 725 to 710. Yet the number of people affected collapsed by nearly 80%, from 289 million to 61.6 million. Breach volume and breach damage do not move together, because a single catastrophic attack can dwarf hundreds of ordinary ones. That is exactly what happened in 2024, and it is the single most important thing to understand before reading any healthcare breach headline.

That quieter middle of the market, practices and mid-size providers without in-house security staff, is precisely who CNiC protects with IT and security built for healthcare organizations. The public portal makes healthcare’s risk measurable in a way few industries can match, and the measurement is unambiguous.

See Managed IT & Security for Healthcare

Source: HHS Office for Civil Rights Breach Portal

2The Change Healthcare Effect: When One Breach Rewrites the Year

No single event has shaped healthcare breach statistics like the ransomware attack on Change Healthcare. In February 2024, attackers compromised the UnitedHealth Group subsidiary that processes a large share of U.S. medical claims. After revising its estimate upward twice, UnitedHealth confirmed the breach exposed the protected health information of about 190 million people, more than half the U.S. population and the largest healthcare data breach ever recorded.

The attack did more than break a record. It exposed how fragile a hyper-consolidated healthcare supply chain has become. Because Change Healthcare sits between providers, pharmacies and payers, the outage stalled claims and prescriptions nationwide for weeks. UnitedHealth reportedly paid a ransom of around $22 million to the ALPHV/BlackCat group, yet stolen data still surfaced on dark-web leak sites after the attackers regrouped under a new banner. Paying did not deliver the outcome the payment was supposed to buy.

Set the single event against the year and the distortion is impossible to miss. Of the roughly 289 million records exposed across all 725 breaches in 2024, about 190 million came from Change Healthcare alone. Strip out that one incident and the remaining 724 breaches account for closer to 99 million people, a figure much nearer to 2025’s 61.6 million. One attack, in other words, more than doubled an entire year’s apparent damage.

Recovering from a ransomware event without paying depends entirely on having isolated, tested backups ready before the attack, the single most reliable path back to operation.

Explore Backup & Disaster Recovery

For the cross-industry picture behind these figures, see our roundup of the average cost of a data breach across all industries and the latest ransomware attack trends.

Source: HHS Office for Civil Rights Breach Portal

3Why Healthcare Is the Costliest Industry to Breach

When a healthcare breach is fully accounted for, it lands at the top of every industry ranking, and it has for well over a decade. IBM’s Cost of a Data Breach Report puts the average healthcare breach at $7.42 million, the highest of any sector for the 13th consecutive year. That figure actually fell from the prior year’s $9.77 million, thanks largely to faster detection driven by security automation, but healthcare still runs far ahead of every other industry and roughly 1.7 times the global cross-industry average.

Healthcare stays the most expensive sector for structural reasons. Medical records are the richest identity dossiers in existence, bundling Social Security numbers, insurance details, diagnoses and payment data that cannot be reset like a password. That makes them lucrative on the dark web and slow to remediate. Add the longest breach lifecycle of any industry, 279 days on average to find and contain an intrusion, and every breach has more time to spread and more data to expose before it is stopped.

Turning that risk into a budget, a roadmap and a defensible security posture is exactly the work of a fractional technology leader.

Explore Virtual CIO Services

Source: IBM Cost of a Data Breach Report

4How Healthcare Networks Actually Get Breached

The public portal records not just how many breaches happen but how. Two data sources, the HHS OCR portal and the Verizon Data Breach Investigations Report, agree on the shape of the threat: healthcare breaches are overwhelmingly deliberate attacks by outsiders, they start with hacking rather than lost laptops, and they increasingly aim at the systems where records live in bulk.

The Verizon data captures a clear shift in tactics. System intrusion, the multi-step pattern that includes hacking, malware and ransomware, surged from 36% to 53% of healthcare breaches to become the leading category, while the old top cause, simple staff errors like misdelivered records, receded. Attackers are working harder and reaching deeper. The move of records onto network servers means a single successful intrusion now exposes far more people than a lost device ever could, which is why 61.5% of all breached PHI now sits on servers.

The controls that break this chain are the disciplined basics applied consistently: multi-factor authentication on every account, phishing-resistant email defenses, patched servers, network segmentation and continuous monitoring. Running them day and night across a clinical environment is the core of managed security.

Explore Cybersecurity Services

For a closer look at the entry point behind most intrusions, our phishing attack data and our manufacturing cybersecurity data show how the same patterns play out across sectors.

Source: HHS Office for Civil Rights Breach Portal | Verizon Data Breach Investigations Report

5When a Breach Reaches the Bedside

In most industries a data breach is a financial and reputational event. In healthcare it can become a clinical one. When ransomware locks the systems that run a hospital, clinicians lose access to records, imaging, medication systems and scheduling, and care slows or stops. The Ponemon Institute and Proofpoint measured this directly in their study of U.S. healthcare providers, and the findings move the conversation from dollars to patient outcomes.

The survey detail shows exactly how a breach turns into a clinical risk. Among organizations hit by ransomware, the most common consequences were operational delays that compound into patient harm: longer hospital stays, delayed procedures and tests, complications and diversions to other facilities. Each of these is a documented pathway from a locked server to a worse outcome for a real patient.

Keeping clinical systems available, monitored and quick to restore is the everyday job of a managed IT partner that understands healthcare’s stakes.

Explore Managed IT Services

Source: Ponemon Institute and Proofpoint, Cyber Insecurity in Healthcare

6The Regulatory Bill: HIPAA Enforcement and Penalties

A breach cost does not stop at recovery and downtime. Healthcare is uniquely regulated, and a breach can trigger an HHS Office for Civil Rights investigation, financial penalties and years of corrective-action oversight. OCR enforcement has sharpened in recent years, with a particular focus on the failure that precedes most breaches: not knowing where your risks are in the first place.

The pattern in the enforcement data is a gift to any provider willing to read it: the single most-cited violation is the failure to perform a thorough, organization-wide risk analysis, the foundational requirement of the HIPAA Security Rule. OCR has also run a dedicated Risk Analysis Initiative and a ransomware enforcement push, signaling that “we did not know we had that gap” is no longer a defense. The organizations penalized were not always breached by sophisticated attackers; many simply could not show they had assessed their risks.

Source: HHS Office for Civil Rights HIPAA Enforcement

Summary Table: Every Statistic at a Glance

Frequently Asked Questions

Methodology and Sources

David McFarlene Founder & CEO

David McFarlene is the owner and founder of CNiC Solutions, a trusted IT services and cybersecurity company serving the Houston, TX area. With over 20 years of experience in managed IT, infrastructure design, cloud solutions, and data security, David helps businesses and homeowners stay protected and productive through dependable, personalized technology support. He leads the CNiC Solutions team with a focus on reliability, transparency, and long-term relationships, ensuring clients always have a knowledgeable expert they can trust.

See Full Bio

IT Services Network Cabling Cloud Solutions Cybersecurity Data Backup & Recovery Managed IT Services Infrastructure Management Telecommunications Virtual CIO (vCIO) WebRTC