Healthcare records breached reached 113 million in one period. One incident alone affected one third of Americans indirectly. Hacking accounted for 83 percent of reported incidents.
Key Takeaways
- Change Healthcare breach in Feb 2024 affected 1/3 of Americans indirectly
- Hacking accounted for 83% of healthcare breaches in 2023 per HHS
- In 2023, the healthcare sector experienced 540 data breaches reported to HHS OCR involving over 500 individuals each
- Average healthcare data breach cost $10.93 million in 2023, up 53% from 2020
- OCR 2023: $6.85M in fines from 13 HIPAA settlements
Healthcare breaches are rising, with many incidents involving sensitive patient data and prompting urgent security action.
Related reading
01 · Category
Affected Individuals27 stats
01
Change Healthcare breach in Feb 2024 affected 1/3 of Americans indirectly
02
Anthem breach 2015 exposed 78.8 million individuals' PHI
03
2023 total: 113,628,580 healthcare records breached
04
Ascension breach Oct 2023 impacted 5.6 million patients
05
UnitedHealth/Change Healthcare Feb-Mar 2024: potentially 100 million+ affected
06
2022: 51,077,886 records exposed in healthcare
07
Q4 2023: 32 million records breached in healthcare
08
Premera Blue Cross 2015: 11 million individuals
09
Q1 2024: 10+ million records from 102 breaches
10
2021: 45,429,054 records exposed
11
Community Health Systems 2014: 4.5 million SSNs and records
12
Q2 2024: 12 million records from 86 breaches
13
Medical Informatics Engineering 2023: 3.18 million records
14
2020: 29.8 million records breached
15
UM Health-Sparrow 2023: 1 million+ patients
16
Oregon HHS 2023: 650,000 individuals
17
2019: 41.2 million records
18
Prisma Health 2023: 1.075 million
19
Q3 2023: 38 million records exposed
20
Scripps Health 2021: 147,267 individuals
21
2018: 13 million records
22
Perry Johnson & Associates 2023: 9 million records
23
Walgreens 2023: 14,000 customers
24
2023 average breach size: 133,000 records
25
Mass General Brigham 2023: 196,000 patients
26
Florida HHS 2023: 1.5 million
27
2024 Change HC: 94 million claims data potentially exposed
Interpretation
Affected Individuals Interpretation
After reviewing a decade of data where breaches are measured in populations of small nations, the only diagnosis left is that the entire healthcare system is patient zero for an incurable case of digital hemorrhage.
02 · Category
Breach Methods21 stats
01
Hacking accounted for 83% of healthcare breaches in 2023 per HHS
02
Ransomware attacks caused 67% of healthcare breach notifications 2023
03
Phishing was initial vector in 16% of healthcare breaches per Verizon DBIR 2024
04
2023: 249 hacking incidents out of 540 total healthcare breaches
05
Unauthorized access: 12% of 2023 healthcare breaches
06
Email/phishing breaches: 20% rise in healthcare 2022-2023
07
Improper disposal caused 2% but 5 breaches in Q4 2023
08
Ransomware via Ryuk/Conti hit 25+ hospitals 2020-2023
09
45% of healthcare breaches from third-party vendors 2023
10
Network server hacks: 40% of large breaches 2023 HHS data
11
Email incidents: 154 in 2023 healthcare breaches
12
Lost/stolen devices: 8% of breaches Q1 2024
13
Change HC: BlackCat ransomware via compromised credentials
14
Insider threats: 19% of healthcare incidents per Verizon 2024
15
Portal/website hacks: 25 breaches in 2023
16
2023: 67 ransomware notifications to HHS healthcare
17
Physical security breaches: 1% but notable in small clinics
18
Supply chain attacks like Change HC: 15% rise 2023
19
EHR system vulnerabilities exploited in 30% hacking cases
20
Privilege misuse: 10% of Verizon-tracked healthcare breaches
21
Q2 2024: 72 hacking/IT incidents out of 86
Interpretation
Breach Methods Interpretation
While the healthcare industry is frantically bolting the front door against ransomware gangs, hackers are waltzing through the digital backdoor, pilfering data from vendors, phishing credentials from inboxes, and exploiting the alarming fact that nearly half of all breaches stem from trusted third parties who were supposed to help guard the castle.
03 · Category
Breach Volume Trends30 stats
01
In 2023, the healthcare sector experienced 540 data breaches reported to HHS OCR involving over 500 individuals each
02
From 2018 to 2023, healthcare breaches increased by 62%, totaling over 2,500 incidents
03
In Q1 2024, 102 healthcare breaches were reported, a 25% rise from Q1 2023
04
2023 saw 113 million healthcare records exposed, the highest annual total on record
05
Hacking/IT incidents accounted for 83% of large healthcare breaches in 2023
06
Between Jan 2022 and Dec 2023, 196 healthcare organizations reported breaches to HHS
07
In 2022, healthcare had 706 breaches affecting 51.5 million people
08
Q4 2023 recorded 152 healthcare breaches, up 43% from Q4 2022
09
Over 5 years to 2023, healthcare breaches grew 300% in volume
10
2021 had 714 healthcare breaches reported to HHS
11
In 2024 YTD (as of Oct), 379 healthcare breaches reported
12
2020 saw 590 breaches in healthcare, down from 2019's 654
13
From 2009-2023, total healthcare breaches exceed 40,000 affecting billions cumulatively
14
Q2 2024 had 86 healthcare breaches
15
2019 recorded 654 healthcare data breaches
16
Healthcare breaches doubled from 2019 to 2023
17
In 2023, 1 in 3 healthcare orgs faced a breach
18
2022 Q3 saw 136 breaches, highest quarterly in healthcare history then
19
Cumulative breaches since 2009: 35,000+
20
2023 breaches cost healthcare $10.93M average per incident
21
Q1-Q3 2024: 253 breaches reported
22
2018 had 353 breaches
23
Breaches rose 20% YoY in healthcare 2022-2023
24
2021 Q4: 110 breaches
25
Healthcare phishing-related breaches up 50% in 2023
26
2017: 234 breaches reported
27
2024 projected 600+ breaches based on trends
28
Mid-2023 spike: 300 breaches H1
29
2016: 380 breaches
30
Ransomware breaches in healthcare tripled 2020-2023
Interpretation
Breach Volume Trends Interpretation
The healthcare sector's data is hemorrhaging at an alarming rate, setting grim new records with each passing year as if patient privacy were a condition with an increasingly poor prognosis.
More related reading
04 · Category
Financial Costs23 stats
01
Average healthcare data breach cost $10.93 million in 2023, up 53% from 2020
02
Total cost of 2023 healthcare breaches estimated at $6.5 billion industry-wide
03
IBM 2023: Lost business costs averaged $3.32M per healthcare breach
04
Notification costs per record: $7.59in healthcare 2023
05
Change Healthcare breach disruption cost UnitedHealth $872M in Q1 2024
06
Average detection/investigation cost $1.52M per healthcare breach 2023
07
Ransomware breach costs in healthcare: $4.44M avg above normal 2023
08
Ponemon 2023: Healthcare post-breach turnover costs $1.8M avg
09
Anthem settlement 2018: $115M for 78.8M breach victims
10
Equifax-like healthcare fines total $100M+ since 2017
11
IBM: Customer churn post-breach costs healthcare $1.9M avg 2023
12
Premera settlement 2021: $74M for 11M breach
13
2023 healthcare breach fines: $6.85M total OCR penalties
14
Average lost revenue per healthcare breach: $1.94M in 2023
15
Community Health Systems 2018: $2.2M OCR fine post-breach
16
Ponemon: Incident response costs $1.6M avg for healthcare 2023
17
Scripps Health ransomware 2021 cost $112M estimated
18
2022 total healthcare breach costs: $5.9B projected
19
OCR 2023 settlements: $6.85M from 13 cases
20
Average fines per violation: $50,000-$1.5M in healthcare cases
21
Universal Health Services ransomware 2020: $67M costs
22
2021 healthcare avg cost $9.23M per breach
23
Change HC projected annual cost: $2.3B+ to UnitedHealth
Interpretation
Financial Costs Interpretation
The bill for healthcare’s digital negligence reads like a horror movie sequel where the monster is both ransomware and sheer bureaucratic incompetence, leaving patients holding the bag and executives holding a $10.93 million dollar invoice.
05 · Category
Regulatory Actions20 stats
01
OCR 2023: $6.85M in fines from 13 HIPAA settlements
02
Anthem 2018: $16M OCR penalty plus $115M class action
03
Premera Blue Cross 2021: OCR $6.85M settlement
04
Community Health Systems 2018: $2.175M OCR fine
05
2023 OCR healthcare fines: Avow Hospice $2.5M for PHI disclosure
06
Scripps Health 2023: Corrective action post-ransomware no fine yet
07
UM Health-Sparrow 2024: OCR investigation ongoing
08
2022 OCR resolutions: 12 healthcare entities $4.3M total
09
Florida HHS 2023: No fine yet, notification to 1.5M
10
Ascension 2024: HHS OCR breach portal listing 5.6M
11
Mass General Brigham 2023: OCR review initiated
12
Perry Johnson 2023: 9M records, OCR reported
13
2021: OCR $4.2M from 10 healthcare cases
14
Change Healthcare: HHS audit and potential fines pending 2024
15
Walgreens 2023: OCR notification for 14K, no penalty
16
Oregon HHS 2023: 650K notified per HHS rules
17
Prisma Health 2023: HHS listed, corrective measures
18
2020 OCR healthcare fines: $6.2M total
19
Medical Informatics Eng 2023: OCR portal entry 3.18M
20
Average OCR fine per healthcare settlement 2023: $527K
Interpretation
Regulatory Actions Interpretation
Apparently, the cost of treating patient data like a casual group chat has now been upgraded from a stern memo to a bill averaging over half a million dollars per institutional oopsie.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Samuel Norberg. (2026, February 13). Healthcare Breach Statistics. Gitnux. https://gitnux.org/healthcare-breach-statistics
MLA
Samuel Norberg. "Healthcare Breach Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/healthcare-breach-statistics.
Chicago
Samuel Norberg. 2026. "Healthcare Breach Statistics." Gitnux. https://gitnux.org/healthcare-breach-statistics.
Sources & references
12 datasets cited across this report · attribution is report-level