Gitnux/Report 2026

Healthcare Breach Statistics

Hacking drove 83% of healthcare breaches in 2023. See the threats behind the headlines and the kinds of data most often exposed.
121Statistics
5Sections
7mRead
July 23, 2026Updated
Healthcare Breach Statistics
Samuel NorbergWritten by Samuel Norberg·Edited by Nicholas Chambers·Fact-checked by Abigail Foster
Published ·Updated
How this report is researched
01Editorial Scope

Gitnux editors write the brief first: the topic, the inclusion rules, and the frame for what belongs.

02Source Research

Agents search the published record and log every extracted figure back to the passage it came from.

Read our full methodology →

Search agents attach provenance to every extracted figure.

Next review: within 35 days
Healthcare breach fallout can reach far beyond the patients whose records are affected. Across 2023 and into early 2024, this page covers reported breach volume and growth, the methods that most often trigger incidents, and the scale of records exposed. You’ll also find an outcomes lens—notification and recovery expenses, plus OCR settlement and fine amounts—so the statistics connect to real-world impact.

Key Takeaways

  • Change Healthcare breach in Feb 2024 affected 1/3 of Americans indirectly
  • Anthem breach 2015 exposed 78.8 million individuals' PHI
  • 2023 total: 113,628,580 healthcare records breached
  • Hacking accounted for 83% of healthcare breaches in 2023 per HHS
  • Ransomware attacks caused 67% of healthcare breach notifications 2023
  • Phishing was initial vector in 16% of healthcare breaches per Verizon DBIR 2024
  • In 2023, the healthcare sector experienced 540 data breaches reported to HHS OCR involving over 500 individuals each
  • From 2018 to 2023, healthcare breaches increased by 62%, totaling over 2,500 incidents
  • In Q1 2024, 102 healthcare breaches were reported, a 25% rise from Q1 2023
  • Average healthcare data breach cost $10.93 million in 2023, up 53% from 2020
  • Total cost of 2023 healthcare breaches estimated at $6.5 billion industry-wide
  • IBM 2023: Lost business costs averaged $3.32M per healthcare breach
  • OCR 2023: $6.85M in fines from 13 HIPAA settlements
  • Anthem 2018: $16M OCR penalty plus $115M class action
  • Premera Blue Cross 2021: OCR $6.85M settlement

In 2023, 113 million healthcare records were exposed, largely by hacking, driving rising breach costs and fines.

Related reading

01 · Category

Affected Individuals27 stats

01
Change Healthcare breach in Feb 2024 affected 1/3 of Americans indirectly
02
Anthem breach 2015 exposed 78.8 million individuals' PHI
03
2023 total: 113,628,580 healthcare records breached
04
Ascension breach Oct 2023 impacted 5.6 million patients
05
UnitedHealth/Change Healthcare Feb-Mar 2024: potentially 100 million+ affected
06
2022: 51,077,886 records exposed in healthcare
07
Q4 2023: 32 million records breached in healthcare
08
Premera Blue Cross 2015: 11 million individuals
09
Q1 2024: 10+ million records from 102 breaches
10
2021: 45,429,054 records exposed
11
Community Health Systems 2014: 4.5 million SSNs and records
12
Q2 2024: 12 million records from 86 breaches
13
Medical Informatics Engineering 2023: 3.18 million records
14
2020: 29.8 million records breached
15
UM Health-Sparrow 2023: 1 million+ patients
16
Oregon HHS 2023: 650,000 individuals
17
2019: 41.2 million records
18
Prisma Health 2023: 1.075 million
19
Q3 2023: 38 million records exposed
20
Scripps Health 2021: 147,267 individuals
21
2018: 13 million records
22
Perry Johnson & Associates 2023: 9 million records
23
Walgreens 2023: 14,000 customers
24
2023 average breach size: 133,000 records
25
Mass General Brigham 2023: 196,000 patients
26
Florida HHS 2023: 1.5 million
27
2024 Change HC: 94 million claims data potentially exposed
Interpretation

Affected Individuals Interpretation

In the Affected Individuals category, the scale of harm is consistently massive, with 2023 reaching 113,628,580 breached healthcare records and the Feb to Mar 2024 UnitedHealth and Change Healthcare incident potentially affecting 100 million or more people indirectly.

02 · Category

Breach Methods21 stats

01
Hacking accounted for 83% of healthcare breaches in 2023 per HHS
02
Ransomware attacks caused 67% of healthcare breach notifications 2023
03
Phishing was initial vector in 16% of healthcare breaches per Verizon DBIR 2024
04
2023: 249 hacking incidents out of 540 total healthcare breaches
05
Unauthorized access: 12% of 2023 healthcare breaches
06
Email/phishing breaches: 20% rise in healthcare 2022-2023
07
Improper disposal caused 2% but 5 breaches in Q4 2023
08
Ransomware via Ryuk/Conti hit 25+ hospitals 2020-2023
09
45% of healthcare breaches from third-party vendors 2023
10
Network server hacks: 40% of large breaches 2023 HHS data
11
Email incidents: 154 in 2023 healthcare breaches
12
Lost/stolen devices: 8% of breaches Q1 2024
13
Change HC: BlackCat ransomware via compromised credentials
14
Insider threats: 19% of healthcare incidents per Verizon 2024
15
Portal/website hacks: 25 breaches in 2023
16
2023: 67 ransomware notifications to HHS healthcare
17
Physical security breaches: 1% but notable in small clinics
18
Supply chain attacks like Change HC: 15% rise 2023
19
EHR system vulnerabilities exploited in 30% hacking cases
20
Privilege misuse: 10% of Verizon-tracked healthcare breaches
21
Q2 2024: 72 hacking/IT incidents out of 86
Interpretation

Breach Methods Interpretation

For the breach methods facing healthcare in 2023, hacking drove 83% of incidents and made up 249 of 540 total breaches, while ransomware-related notifications accounted for 67%, showing that cyber intrusion techniques dominate the category.

More related reading

04 · Category

Financial Costs23 stats

01
Average healthcare data breach cost $10.93 million in 2023, up 53% from 2020
02
Total cost of 2023 healthcare breaches estimated at $6.5 billion industry-wide
03
IBM 2023: Lost business costs averaged $3.32M per healthcare breach
04
Notification costs per record: $7.59in healthcare 2023
05
Change Healthcare breach disruption cost UnitedHealth $872M in Q1 2024
06
Average detection/investigation cost $1.52M per healthcare breach 2023
07
Ransomware breach costs in healthcare: $4.44M avg above normal 2023
08
Ponemon 2023: Healthcare post-breach turnover costs $1.8M avg
09
Anthem settlement 2018: $115M for 78.8M breach victims
10
Equifax-like healthcare fines total $100M+ since 2017
11
IBM: Customer churn post-breach costs healthcare $1.9M avg 2023
12
Premera settlement 2021: $74M for 11M breach
13
2023 healthcare breach fines: $6.85M total OCR penalties
14
Average lost revenue per healthcare breach: $1.94M in 2023
15
Community Health Systems 2018: $2.2M OCR fine post-breach
16
Ponemon: Incident response costs $1.6M avg for healthcare 2023
17
Scripps Health ransomware 2021 cost $112M estimated
18
2022 total healthcare breach costs: $5.9B projected
19
OCR 2023 settlements: $6.85M from 13 cases
20
Average fines per violation: $50,000-$1.5M in healthcare cases
21
Universal Health Services ransomware 2020: $67M costs
22
2021 healthcare avg cost $9.23M per breach
23
Change HC projected annual cost: $2.3B+ to UnitedHealth
Interpretation

Financial Costs Interpretation

From a financial costs perspective, healthcare breaches are getting dramatically more expensive with the average cost rising to $10.93 million in 2023, a 53% increase from 2020, while the industry collectively faced an estimated $6.5 billion in total breach costs that year.

05 · Category

Regulatory Actions20 stats

01
OCR 2023: $6.85M in fines from 13 HIPAA settlements
02
Anthem 2018: $16M OCR penalty plus $115M class action
03
Premera Blue Cross 2021: OCR $6.85M settlement
04
Community Health Systems 2018: $2.175M OCR fine
05
2023 OCR healthcare fines: Avow Hospice $2.5M for PHI disclosure
06
Scripps Health 2023: Corrective action post-ransomware no fine yet
07
UM Health-Sparrow 2024: OCR investigation ongoing
08
2022 OCR resolutions: 12 healthcare entities $4.3M total
09
Florida HHS 2023: No fine yet, notification to 1.5M
10
Ascension 2024: HHS OCR breach portal listing 5.6M
11
Mass General Brigham 2023: OCR review initiated
12
Perry Johnson 2023: 9M records, OCR reported
13
2021: OCR $4.2M from 10 healthcare cases
14
Change Healthcare: HHS audit and potential fines pending 2024
15
Walgreens 2023: OCR notification for 14K, no penalty
16
Oregon HHS 2023: 650K notified per HHS rules
17
Prisma Health 2023: HHS listed, corrective measures
18
2020 OCR healthcare fines: $6.2M total
19
Medical Informatics Eng 2023: OCR portal entry 3.18M
20
Average OCR fine per healthcare settlement 2023: $527K
Interpretation

Regulatory Actions Interpretation

In the Regulatory Actions category, OCR enforcement shows a clear pattern of multi‑million dollar outcomes, with 2021 Premera Blue Cross paying $6.85M and 2023 healthcare fines reaching $2.5M for PHI disclosure, while larger cases like Anthem in 2018 combined a $16M OCR penalty with a $115M class action.
Reference

Cite This Report

This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.

APA
Samuel Norberg. (2026, February 13). Healthcare Breach Statistics. Gitnux. https://gitnux.org/healthcare-breach-statistics
MLA
Samuel Norberg. "Healthcare Breach Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/healthcare-breach-statistics.
Chicago
Samuel Norberg. 2026. "Healthcare Breach Statistics." Gitnux. https://gitnux.org/healthcare-breach-statistics.

Sources & references

12 datasets cited across this report

hipaajournal.comhhs.govphivacy.comibm.comocrportal.hhs.govverizon.componemon.orgkrebsonsecurity.comreuters.comjustice.govbeckershospitalreview.comcnbc.com