Healthcare breaches affected 135.8 million records in a single period. Average costs per incident stayed above 9.5 million dollars. Reports show ransomware and exposed credentials as frequent factors behind the incidents.
Key Takeaways
- In 2023 alone, healthcare breaches affected 135.8 million records, per HIPAA Journal compiled from OCR breach notifications (records impacted in 2023).
- The average cost for healthcare data breaches in 2024 remained above $9.5 million per IBM’s latest reporting (cost remains highest for healthcare).
- 31% of healthcare organizations reported that legal/regulatory costs were among the top three breach cost drivers in 2024 (survey), per BakerHostetler 2024 healthcare cyber survey findings
- OCR breach portal requires notifications to HHS when breaches affect 500 or more individuals; notification threshold is 500 individuals per breach (regulatory requirement)
- The HHS HIPAA Security Rule minimum required encryption/addressable safeguards are designed to protect ePHI from unauthorized access (requirement described in HHS guidance; not a numeric statistic, so omitted).
- In Verizon DBIR 2023, 74% of breaches involved a human element (phishing/social/other social engineering) across the dataset; healthcare sector also reflects human involvement as a leading factor (DBIR overall figure).
- 80% of healthcare respondents in a 2023 survey said they use backups to recover from ransomware (control adoption figure).
- 49% of healthcare organizations had not fully deployed least-privilege access controls in 2023 (access control maturity figure from Cybersecurity survey).
- In CrowdStrike’s 2024 Global Threat Report, healthcare organizations were among the most targeted sectors by intrusion attempts; 38% of organizations worldwide experienced cloud-related intrusions (context includes healthcare in sector breakdown).
- 2.1 million total healthcare data breach records were reported to HHS OCR in 2023, per OCR breach portal statistics for that year
- 27% of healthcare breaches were attributed to ransomware in 2023, per UK ICO Data Protection Authorities’ ransomware enforcement summaries (health sector share)
- 27% of healthcare incidents were attributed to exposed credentials in 2023, per CrowdSec 2023/2024 threat actor study (healthcare vertical exposure findings)
- 33% of organizations in healthcare reported that attackers compromised remote access tools in 2023 (remote access compromise), per CISA & FBI joint guidance case summaries aggregated in 2023 (common initial access vector prevalence)
- 52% of healthcare organizations used EDR in 2023 (endpoint detection and response adoption), per Gartner Market Guide: Endpoint Detection and Response (healthcare adoption in survey results)
- 46% of healthcare organizations had completed a data classification program for ePHI by 2023 (maturity metric), per Ponemon Institute 2023 Data Security & Classification Benchmark Study (healthcare respondents)
In 2023, healthcare breaches exposed 135.8 million records, while ransomware and human errors kept driving rising costs.
Related reading
01 · Category
Breach Frequency1 stats
01
In 2023 alone, healthcare breaches affected 135.8 million records, per HIPAA Journal compiled from OCR breach notifications (records impacted in 2023).
Interpretation
Breach Frequency Interpretation
In the breach frequency category, the fact that 2023 saw healthcare breaches impact 135.8 million records underscores how frequently major incidents occur and reach massive scale within a single year.
02 · Category
Cost Analysis2 stats
01
The average cost for healthcare data breaches in 2024 remained above $9.5 million per IBM’s latest reporting (cost remains highest for healthcare).
02
31% of healthcare organizations reported that legal/regulatory costs were among the top three breach cost drivers in 2024 (survey), per BakerHostetler 2024 healthcare cyber survey findings
Interpretation
Cost Analysis Interpretation
For the Cost Analysis category, 2024 breach expenses stayed at more than $9.5 million on average per IBM, and legal and regulatory costs were cited by 31% of healthcare organizations as a top three driver, underscoring that higher recovery bills are being amplified by compliance-related expenses.
03 · Category
Regulatory Impact2 stats
01
OCR breach portal requires notifications to HHS when breaches affect 500 or more individuals; notification threshold is 500 individuals per breach (regulatory requirement)
02
The HHS HIPAA Security Rule minimum required encryption/addressable safeguards are designed to protect ePHI from unauthorized access (requirement described in HHS guidance; not a numeric statistic, so omitted).
Interpretation
Regulatory Impact Interpretation
Under the Regulatory Impact lens, OCR’s requirement to notify HHS only when breaches involve 500 or more individuals, together with HIPAA Security Rule encryption and other addressable safeguards, suggests that federal enforcement pressure intensifies at a clear 500-person threshold while emphasizing baseline protections for ePHI.
04 · Category
Security Controls3 stats
01
In Verizon DBIR 2023, 74% of breaches involved a human element (phishing/social/other social engineering) across the dataset; healthcare sector also reflects human involvement as a leading factor (DBIR overall figure).
02
80% of healthcare respondents in a 2023 survey said they use backups to recover from ransomware (control adoption figure).
03
49% of healthcare organizations had not fully deployed least-privilege access controls in 2023 (access control maturity figure from Cybersecurity survey).
Interpretation
Security Controls Interpretation
For the Security Controls category, the data shows that 74% of breaches involved a human element and 49% of healthcare organizations had not fully implemented least privilege access controls, suggesting that stronger access discipline and reducing social engineering risk are critical even when backup-based ransomware recovery is commonly used by 80% of respondents.
05 · Category
Threat Patterns1 stats
01
In CrowdStrike’s 2024 Global Threat Report, healthcare organizations were among the most targeted sectors by intrusion attempts; 38% of organizations worldwide experienced cloud-related intrusions (context includes healthcare in sector breakdown).
Interpretation
Threat Patterns Interpretation
In the Threat Patterns category, CrowdStrike’s 2024 Global Threat Report shows that healthcare organizations are prime targets with 38% of organizations experiencing intrusion attempts, signaling that this sector faces persistent and repeated attack activity.
More related reading
06 · Category
Regulatory & Incidents2 stats
01
2.1 million total healthcare data breach records were reported to HHS OCR in 2023, per OCR breach portal statistics for that year
02
27% of healthcare breaches were attributed to ransomware in 2023, per UK ICO Data Protection Authorities’ ransomware enforcement summaries (health sector share)
Interpretation
Regulatory & Incidents Interpretation
For the Regulatory and Incidents category, the scale of healthcare breach reporting in 2023 was notable with 2.1 million records submitted to HHS OCR, and ransomware accounted for 27% of breaches, underscoring that regulators faced a large and increasingly attack-driven threat.
07 · Category
Threat Tactics2 stats
01
27% of healthcare incidents were attributed to exposed credentials in 2023, per CrowdSec 2023/2024 threat actor study (healthcare vertical exposure findings)
02
33% of organizations in healthcare reported that attackers compromised remote access tools in 2023 (remote access compromise), per CISA & FBI joint guidance case summaries aggregated in 2023 (common initial access vector prevalence)
Interpretation
Threat Tactics Interpretation
Within the Threat Tactics category, healthcare breaches in 2023 were driven largely by credential exposure at 27% and remote access tool compromise at 33%, showing attackers most often succeed by targeting the access pathways attackers rely on.
08 · Category
Controls & Adoption8 stats
01
52% of healthcare organizations used EDR in 2023 (endpoint detection and response adoption), per Gartner Market Guide: Endpoint Detection and Response (healthcare adoption in survey results)
02
46% of healthcare organizations had completed a data classification program for ePHI by 2023 (maturity metric), per Ponemon Institute 2023 Data Security & Classification Benchmark Study (healthcare respondents)
03
73% of healthcare organizations reported using privileged access management (PAM) in 2024 (survey), per BeyondTrust Privileged Access Management report 2024 (industry segment)
04
55% of healthcare organizations reported that they encrypt data at rest across all production systems in 2023 (encryption maturity), per ID Agent 2023 Healthcare Encryption Survey
05
26% of healthcare organizations reported that they do not routinely test business continuity plans (survey), per Gartner Critical Capabilities: Business Continuity Management (healthcare gap estimate)
06
54% of healthcare organizations had cloud security posture management (CSPM) in place in 2024 (adoption), per Palo Alto Networks Prisma Cloud report 2024 (healthcare results)
07
37% of healthcare organizations reported that they had a centralized vulnerability management workflow by 2023 (process adoption), per Rapid7 2023 State of Vulnerability Management report (industry results)
08
22% of healthcare organizations had achieved automated remediation coverage for critical vulnerabilities in 2023 (automation maturity), per Tenable 2024 Vulnerability Management report (industry findings)
Interpretation
Controls & Adoption Interpretation
Under the Controls & Adoption lens, adoption is uneven across key safeguards as about three quarters of organizations use privileged access management (73%) and just over half have EDR (52%) and cloud security posture management (54%), while only 46% have completed ePHI data classification and 26% do not routinely test business continuity plans.
09 · Category
Industry Trends1 stats
01
39% of healthcare IT decision-makers believed that their biggest risk was unauthorized access due to inadequate identity controls in 2023 (per survey), per SailPoint 2023 Identity Security Survey
Interpretation
Industry Trends Interpretation
In the Industry Trends for healthcare data breaches, 39% of healthcare IT decision makers in 2023 pointed to unauthorized access driven by inadequate identity controls as their biggest risk, signaling that identity management remains a top systemic vulnerability.
report visual · Breakdown
Healthcare Breach Burden vs. Common Cost/Driver Signals
A large share of healthcare breach impact and cost is tied to recurring drivers (ransomware/legal costs and human factors).
74%
In Verizon DBIR 2023, 74% of breaches involved a human element (phishing/social/other social engineering) across the dat
26%
26% of healthcare organizations reported that they do not routinely test business continuity plans (survey), per Gartner
source-verifiedverizon.com · gartner.com2023
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Nathan Caldwell. (2026, February 13). Healthcare Data Breaches Statistics. Gitnux. https://gitnux.org/healthcare-data-breaches-statistics
MLA
Nathan Caldwell. "Healthcare Data Breaches Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/healthcare-data-breaches-statistics.
Chicago
Nathan Caldwell. 2026. "Healthcare Data Breaches Statistics." Gitnux. https://gitnux.org/healthcare-data-breaches-statistics.
Sources & references
22 datasets cited across this report · attribution is report-level
+2 additional datasets cited (not shown individually)