Seventy-four percent of U.S. healthcare organizations that experienced a cyberattack in the past year reported disruptions to patient care, an Oct. 13 report from cybersecurity company Proofpoint and IT security research organization Ponemon Institute found.
The fifth annual “Cyber Insecurity in Healthcare” report surveyed 705 IT and IT security practitioners at U.S. healthcare organizations. It found that cyberattacks are becoming more frequent and costly, while healthcare organizations are adopting artificial intelligence faster than they are putting security governance in place.
Here are seven things to know from the report:
- Cyberattacks are disrupting patient care. Ninety-seven percent of organizations surveyed reported experiencing at least one cyberattack in the past 12 months, and 74% of those organizations reported disruptions to patient care.
- The report examined four types of attacks: cloud or account compromise, ransomware, supply chain attacks and business email compromise. Across those four types, an average of 53% of respondents reporting care disruptions cited increased complications from medical procedures, 52% cited longer patient stays and 52% cited delays in tests or procedures. Supply chain attacks had the greatest impact on patient care, with 90% of affected organizations reporting care disruptions, up from 87% in 2025. Business email compromise was most associated with delays in procedures and tests resulting in poor outcomes, at 68%.
- Data loss incidents are reaching patient care. Organizations reported an average of 21 incidents involving the loss or exfiltration of sensitive healthcare information over two years. Fifty-four percent of respondents said those incidents disrupted patient care, and 56% of that group reported increased mortality rates. Employee negligence remained the leading reported cause of data loss, while 24% of respondents identified AI agents operating without guardrails as a cause.
- Cyberattacks are increasing in frequency and cost. The average number of attacks increased from 43 in 2025 to 51 in 2026. The average cost of an organization’s most expensive attack rose from $3.9 million in 2025 to $4.2 million in 2026, an increase of nearly 8%. Disruption to normal healthcare operations was the largest cost category, averaging $1.39 million, followed by $1.05 million in idle time and lost productivity.
- Healthcare AI adoption is outpacing security governance. Forty-five percent of organizations have incorporated AI into cybersecurity or both cybersecurity and patient care, while another 30% plan to adopt it. However, 60% reported lacking controls governing sensitive data used in AI systems, and just 42% use security measures specifically designed for AI systems, agents and generative AI. Only 32% reported having full visibility into employees’ use of unsanctioned AI tools. Respondents cited supply chain risk from AI vendors (40%), data leakage through AI prompts (36%), and AI-generated phishing and social engineering (34%) as their leading AI-specific security concerns.
- Cloud adoption is creating additional cybersecurity exposure. Thirty-five percent of organizations have moved clinical applications to the cloud, up from 30% in 2025, while another 44% plan to do so within the next two years. Organizations experienced up to 20 cloud or account compromises on average, and those compromises disrupted patient care for 65% of respondents.
- Thirty-one percent of organizations experiencing ransomware attacks reported paying a ransom, down from 33% in 2025. The average costliest ransom payment also declined from $1.2 million to $1.1 million. Despite those decreases, 72% of organizations experiencing ransomware reported patient care disruptions, up from 67% in 2025. Among those reporting disruptions, 70% cited longer patient stays.
The post 74% of attacked healthcare organizations report care disruptions: 7 things to know appeared first on Becker's Hospital Review | Healthcare News & Analysis.