Healthcare data breaches affect patients, providers, and insurers across the United States, from large national incidents to smaller breaches that can still expose medical and billing information. Reporting patterns show that hacking and IT failures remain prominent, with unauthorized access and phishing-linked ransomware often driving entry. Next, you’ll explore how breach frequency and record exposure have shifted over time, the most common threat vectors, and how costs can spread from notification and recovery to broader economic impact.
Key Takeaways
- In 2023, the healthcare sector experienced 540 major data breaches reported to HHS OCR, marking a 68% increase from 2022.
- From 2018 to 2023, healthcare breaches totaled over 2,500 incidents according to HHS data.
- In Q1 2024, 102 healthcare breaches were reported, affecting 20 million records.
- Hacking/IT incidents accounted for 83% of healthcare breaches in 2023.
- Ransomware attacks caused 25% of large healthcare breaches (>500 records) in 2022.
- Unauthorized access was the vector in 45% of 2023 HHS-reported breaches.
- Average cost of healthcare data breach in 2023 was $10.93 million per IBM report.
- Ransomware costs for healthcare averaged $4.44 million per incident in 2022 Ponemon.
- Total economic impact of 2023 healthcare breaches exceeded $10 billion.
- In 2023, over 100 million healthcare records were compromised across 540 breaches reported to HHS OCR.
- The 2022 Change Healthcare breach exposed 1/3 of Americans' data, affecting 100 million+ individuals.
- Q1 2024 healthcare breaches impacted 42 million records.
- Healthcare breaches increased 300% since 2019 per HHS trends.
- Ransomware incidents in healthcare rose 45% YoY in 2023.
- AI-driven threats expected to cause 30% more breaches by 2025.
Healthcare breaches soared in 2023 with hacking driving 83 percent, impacting over 100 million records and costing billions.
Related reading
01 · Category
Breach Incidents30 stats
01
In 2023, the healthcare sector experienced 540 major data breaches reported to HHS OCR, marking a 68% increase from 2022.
02
From 2018 to 2023, healthcare breaches totaled over 2,500 incidents according to HHS data.
03
In Q1 2024, 102 healthcare breaches were reported, affecting 20 million records.
04
2022 saw 707 healthcare breach notifications to HHS, the highest annual count on record.
05
Between January and June 2023, 257 healthcare entities reported breaches to OCR.
06
In 2021, 714 healthcare breaches were disclosed, up 58% from 2020.
07
Q4 2023 recorded 158 healthcare breaches, a 20% rise from Q3.
08
From 2009 to 2023, cumulative healthcare breaches reached 5,000+ per HHS portal.
09
2020 had 523 healthcare breach reports amid COVID-19 surge.
10
In 2019, 510 healthcare data breaches were reported to HHS OCR.
11
First half of 2022 saw 343 healthcare breaches, doubling prior year.
12
2023 Q2 reported 136 healthcare incidents to OCR.
13
Hospitals reported 45 breaches in 2023, per HHS data.
14
Health plans faced 112 breaches in 2022.
15
2018 recorded 353 healthcare breaches, starting upward trend.
16
Q1 2023 had 110 healthcare breach notifications.
17
2024 YTD (as of June) shows 250+ healthcare breaches.
18
Business associates reported 180 breaches in 2023.
19
2017 saw 231 healthcare data incidents.
20
Pharmacies reported 25 breaches in 2022.
21
2023 total breaches hit 725 including small ones under 500 records.
22
EHR vendors involved in 50+ breaches since 2020.
23
2021 Q4 had 189 healthcare breaches.
24
Telehealth platforms reported 15 breaches in 2022.
25
2016 healthcare breaches totaled 165.
26
Insurers faced 90 breaches in 2023.
27
2022 saw 120 ransomware-related healthcare breaches.
28
Ambulatory centers reported 35 incidents in 2021.
29
2023 Q3 recorded 142 healthcare breaches.
30
Cumulative 2020-2023 breaches exceed 2,000.
Interpretation
Breach Incidents Interpretation
In the breach incidents category, reports surged as major healthcare data breaches hit 540 in 2023, a 68% jump from 2022, after yearly notifications peaked at 707 in 2022, showing a clear escalation in breach reporting intensity over recent years.
02 · Category
Breach Vectors28 stats
01
Hacking/IT incidents accounted for 83% of healthcare breaches in 2023.
02
Ransomware attacks caused 25% of large healthcare breaches (>500 records) in 2022.
03
Unauthorized access was the vector in 45% of 2023 HHS-reported breaches.
04
Phishing led to 60% of healthcare ransomware incidents per Verizon DBIR 2023.
05
Email compromise vector in 32% of healthcare breaches 2022.
06
Improper disposal caused 12% of breaches under 500 records in 2023.
07
Malware was involved in 40% of healthcare incidents per Ponemon 2023.
08
Cloud misconfiguration led to 15% of 2023 healthcare exposures.
09
Insider threats accounted for 18% of healthcare breaches in IBM 2023 report.
10
Stolen devices/credentials caused 22% of 2022 incidents.
11
Supply chain attacks hit 28% of healthcare orgs in 2023 per Verizon.
12
Web app vulnerabilities exploited in 10% of breaches Q1 2024.
13
Unencrypted PHI on lost laptops: 8% of incidents 2023.
14
DDoS as distraction in 5% of ransomware healthcare cases 2022.
15
Third-party vendor hacks: 35% of large breaches 2023.
16
Password attacks (brute force) in 25% per DBIR.
17
Physical security breaches: 7% involving paper records 2022.
18
API vulnerabilities exposed data in 12% of 2023 cases.
19
Social engineering: 40% initial access vector IBM 2023.
20
Ransomware groups like LockBit hit 20% of 2023 healthcare breaches.
21
Zero-day exploits rare but in 3% of advanced persistent threats.
22
Lost/stolen unencrypted electronic media: 15% of small breaches.
23
Remote access tool abuse: 28% per IBM Cost of Breach.
24
Fax machine exposures due to unsecured lines: 2% incidents.
25
IoT medical devices hacked in 5% of 2022 cases.
26
Business email compromise (BEC): 10% financial+data loss.
27
SQL injection in legacy systems: 8% web-based breaches.
28
Privilege escalation post-initial access: 65% of ransomware paths.
Interpretation
Breach Vectors Interpretation
In the breach vectors data, hacking and IT incidents drove 83% of healthcare breaches in 2023, and within that landscape unauthorized access accounted for 45% of HHS-reported cases and phishing fueled 60% of healthcare ransomware incidents, showing that the most common vectors are technical intrusions enabled by user and access weaknesses.
03 · Category
Financial Costs30 stats
01
Average cost of healthcare data breach in 2023 was $10.93 million per IBM report.
02
Ransomware costs for healthcare averaged $4.44 million per incident in 2022 Ponemon.
03
Total economic impact of 2023 healthcare breaches exceeded $10 billion.
04
Notification costs alone: $361per record in healthcare 2023 IBM.
05
Change Healthcare breach cost UnitedHealth $872 million in direct expenses.
06
Average downtime from ransomware: 24 days costing $1M+ daily for hospitals.
07
HIPAA fines for breaches totaled $6.85 million in 2023.
08
Lost revenue from breaches: 35% of total cost per IBM 2023.
09
Detection and escalation costs: $1.76 million average healthcare.
10
Post-breach customer churn cost healthcare $4.15 million avg.
11
2022 healthcare breach megacost: $10.1 million average Ponemon.
12
Business associates fines: $50 million+ since 2010.
13
Cyber insurance premiums rose 50% post-2023 breaches.
14
Remediation costs: $3.3 million avg for healthcare IBM.
15
Anthem 2015 breach settlement: $115 million.
16
Ransomware payments averaged $1.54 million in healthcare 2023.
17
Legal fees post-breach: 15% of total costs IBM.
18
2023 Q1 breaches cost $2.5 billion total estimated.
19
Fines for improper safeguards: $2 million avg per case.
20
Productivity loss: $1.2 million per breach healthcare.
21
Premera settlement: $74 million for 11M record breach.
22
Cyber extortion costs up 13% to $5.13 million avg.
23
Hospitals spent $8.6 billion on cybersecurity in 2023.
24
Class action suits averaged $10 million settlements.
25
Backup restoration post-ransomware: $500K avg.
26
2024 projected breach costs: $11.5 million avg healthcare.
27
Vendor management costs rose 20% due to breaches.
28
PHI exposure fines under HITECH: $50K-$1.5M per violation.
29
Total 2022 healthcare cyber costs: $9.8 billion.
30
Incident response retainers: $250K per major breach.
Interpretation
Financial Costs Interpretation
For the Financial Costs category, the data shows that healthcare breaches are not only expensive at an average $10.93 million per incident in 2023 but also create large add-on burdens like $361 in notification cost per record and ransomware downtime that averages 24 days at $1M plus per day, with the overall 2023 economic impact topping $10 billion.
More related reading
04 · Category
Records Impacted30 stats
01
In 2023, over 100 million healthcare records were compromised across 540 breaches reported to HHS OCR.
02
The 2022 Change Healthcare breach exposed 1/3 of Americans' data, affecting 100 million+ individuals.
03
Q1 2024 healthcare breaches impacted 42 million records.
04
From 2009-2023, HHS portal lists breaches affecting 300 million+ records.
05
2021 breaches exposed 45 million patient records.
06
Anthem breach of 2015 remains largest at 78.8 million records.
07
First half 2023 saw 88 million records breached in healthcare.
08
2022 total records affected: 52 million per HHS.
09
Ascension Health breach in 2024 impacted 5.6 million records.
10
Q4 2023 breaches exposed 17 million records.
11
Premera Blue Cross 2015 breach hit 11 million records.
12
2020 breaches affected 28 million records.
13
2019 healthcare breaches compromised 41 million records.
14
UnitedHealth/Optum breach 2024 exposed 64 million records indirectly.
15
Q2 2023 impacted 22 million records across 136 breaches.
16
Largest 2023 breach: PharMerica at 5.8 million records.
17
2018 breaches exposed 13 million records.
18
CommonSpirit Health 2022 breach affected 623,000 records.
19
2023 hospitals breaches impacted 15 million records.
20
Health plans saw 30 million records exposed in 2022.
21
Scripps Health 2021 breach hit 147,000 records.
22
2024 Q1 alone: 20+ million records from 102 breaches.
23
Business associates breaches exposed 40 million in 2023.
24
2017 breaches affected 5.5 million records.
25
Shields Health Care 2023 breach: 2 million records.
26
2022 Q1: 10 million records from 110 breaches.
27
Pharmacies 2022: 5 million records impacted.
28
Total since HIPAA: over 500 million records breached.
29
2021 total: 45.1 million records exposed.
30
Ransomware breaches in healthcare exposed 25 million records in 2023.
Interpretation
Records Impacted Interpretation
Across the records impacted category, the scale of exposure has been steadily massive, from 45 million patient records in 2021 to 78.8 million in the 2015 Anthem breach and more than 100 million compromised records in 2023, with HHS listing breaches tied to 300 million plus records from 2009 to 2023.
05 · Category
Remediation And Trends30 stats
01
Healthcare breaches increased 300% since 2019 per HHS trends.
02
Ransomware incidents in healthcare rose 45% YoY in 2023.
03
AI-driven threats expected to cause 30% more breaches by 2025.
04
MFA adoption reduced breach risk by 99% per Microsoft study.
05
Zero-trust architecture cut detection time by 50% IBM 2023.
06
Healthcare cyber insurance claims doubled in 2023.
07
Average time to identify breach: 277 days healthcare 2023.
08
Containment time post-detection: 84 days avg healthcare.
09
93% of healthcare orgs faced phishing attacks 2023 Verizon.
10
Employee training reduced incidents by 70% per Proofpoint.
11
Projected 2024 breaches: 600+ with 150M records.
12
Cloud security investments up 25% post-breaches.
13
HIPAA audits increased 40% focusing on BAAs 2023.
14
Ransomware recovery without payment: 66% success rate.
15
SEG implementation cut email breaches by 80%.
16
Healthcare CIS benchmarks compliance at 60% avg.
17
Breach disclosure within 60 days: 85% compliance 2023.
18
AI for threat detection adopted by 45% of hospitals.
19
Third-party risk management maturity low at 25%.
20
Global healthcare breaches up 20% outside US 2023.
21
Patch management gaps caused 30% exploited vulns.
22
Incident response plans tested annually by 70% orgs.
23
Quantum threats to encryption projected 2030 impact.
24
Telehealth breaches down 15% with encryption mandates.
25
SOC-as-a-service adoption up 50% post-2023.
26
Patient portal vulnerabilities patched reduced risks 40%.
27
Regulatory changes post-Change HC: stricter BA oversight.
28
Breach fatigue led to 20% underreporting estimates.
29
Cybersecurity workforce shortage: 3.5M globally healthcare.
30
2025 forecast: 25% cost increase without MFA full rollout.
Interpretation
Remediation And Trends Interpretation
For the remediation and trends angle, the clear signal is that while healthcare breaches have surged 300% since 2019 and ransomware rose 45% year over year in 2023, security measures like MFA cutting breach risk by 99% and zero trust reducing detection time by 50% are becoming essential to counter increasingly fast growing threats.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Kevin O'Brien. (2026, February 13). Healthcare Data Breach Statistics. Gitnux. https://gitnux.org/healthcare-data-breach-statistics
MLA
Kevin O'Brien. "Healthcare Data Breach Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/healthcare-data-breach-statistics.
Chicago
Kevin O'Brien. 2026. "Healthcare Data Breach Statistics." Gitnux. https://gitnux.org/healthcare-data-breach-statistics.
Sources & references
12 datasets cited across this report · attribution is report-level