Healthcare Cyberattacks Surge, Driving Higher Costs and Care Disruptions
A new study by the Ponemon Institute and Proofpoint reveals a sharp rise in cyberattacks targeting U.S. healthcare organizations, with escalating financial and operational consequences. Conducted in May 2026, the survey of 705 IT and security practitioners found that 97% of healthcare institutions experienced at least one cyberattack in the past year, up from previous levels, with an average of 51 attacks per organization an increase from 43 in 2025.
The financial toll of these incidents is growing. The average cost of the most expensive attack reached $4.2 million, an 8% increase from 2025, while operational disruption expenses such as system downtime now average $1.39 million, up from $1.2 million. Beyond monetary losses, 74% of respondents reported disruptions to patient care, including delayed procedures, extended hospital stays, and interruptions to critical services.
Ransomware remains a persistent threat, though fewer organizations are paying extortion demands. However, the refusal to pay does not eliminate the fallout, as attacks continue to disrupt clinical workflows and patient outcomes. Susan Biddle, Proofpoint’s director of healthcare solutions, emphasized that cyberattacks are evolving into operational crises, not just IT incidents, with success in cybersecurity increasingly measured by whether clinicians can work and patients can receive care uninterrupted.
The study also highlights growing risks from AI adoption in healthcare. While 45% of organizations have integrated AI into cybersecurity or patient care, and another 30% plan to do so, many lack proper governance. 60% of respondents admitted to insufficient controls over sensitive data used in AI systems, and only 42% employ security measures designed for AI. Key concerns include supply chain risks from AI vendors, data leakage via prompts, AI-generated phishing, and non-compliant tool usage.
Experts at the recent ISMG HealthSec summit stressed the need for cyber resilience in healthcare, where downtime directly impacts patient care. Guru Gurushankar of Color Tokens noted that microsegmentation a proactive defense strategy is essential to prevent breaches from escalating into catastrophic incidents. As AI becomes more embedded in clinical workflows, healthcare organizations must prioritize AI governance, data protection, and third-party risk management to secure both systems and patient care continuity.
The findings underscore a shift in healthcare cybersecurity: preventing attacks is no longer enough organizations must ensure resilience to maintain critical services when breaches occur.
Source: https://www.bankinfosecurity.com/healthcare-cyberattacks-hit-harder-cost-more-a-33077
Proofpoint cybersecurity rating report: https://www.rankiteo.com/company/proofpoint
Ponemon Institute cybersecurity rating report: https://www.rankiteo.com/company/ponemon-institute
"id": "PROPON1791931149",
"linkid": "proofpoint, ponemon-institute",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Patients (74% reported '
'disruptions to patient care)',
'industry': 'healthcare',
'location': 'U.S.',
'type': 'healthcare organizations'}],
'data_breach': {'sensitivity_of_data': 'Sensitive data used in AI systems '
'(60% lack sufficient controls)'},
'date_publicly_disclosed': '2026-05',
'description': 'A new study by the Ponemon Institute and Proofpoint reveals a '
'sharp rise in cyberattacks targeting U.S. healthcare '
'organizations, with escalating financial and operational '
'consequences. 97% of healthcare institutions experienced at '
'least one cyberattack in the past year, with an average of 51 '
'attacks per organization. The financial toll includes an '
'average cost of $4.2 million for the most expensive attack '
'and $1.39 million in operational disruption expenses. 74% of '
'respondents reported disruptions to patient care, including '
'delayed procedures, extended hospital stays, and '
'interruptions to critical services. Ransomware remains a '
'persistent threat, with growing risks from AI adoption in '
'healthcare.',
'impact': {'financial_loss': '$4.2 million (average most expensive attack), '
'$1.39 million (operational disruption expenses)',
'operational_impact': 'Disruptions to patient care, delayed '
'procedures, extended hospital stays, '
'interruptions to critical services'},
'lessons_learned': 'Cyberattacks are evolving into operational crises, not '
'just IT incidents. Success in cybersecurity is '
'increasingly measured by whether clinicians can work and '
'patients can receive care uninterrupted. AI governance, '
'data protection, and third-party risk management are '
'critical.',
'post_incident_analysis': {'corrective_actions': ['Implement AI governance',
'Enhance data protection '
'measures',
'Adopt microsegmentation',
'Strengthen third-party '
'risk management'],
'root_causes': ['Insufficient controls over '
'sensitive data used in AI systems '
'(60% of respondents)',
'Lack of security measures '
'designed for AI (only 42% employ '
'them)',
'Supply chain risks from AI '
'vendors',
'Data leakage via prompts',
'AI-generated phishing',
'Non-compliant tool usage']},
'ransomware': {'ransom_paid': 'Fewer organizations paying extortion demands'},
'recommendations': ['Prioritize AI governance and data protection',
'Implement microsegmentation to prevent breaches from '
'escalating',
'Enhance third-party risk management',
'Ensure cyber resilience to maintain critical services '
'during breaches'],
'references': [{'date_accessed': '2026-05',
'source': 'Ponemon Institute and Proofpoint Study'},
{'source': 'ISMG HealthSec Summit'}],
'response': {'network_segmentation': 'Microsegmentation recommended as a '
'proactive defense strategy'},
'title': 'Healthcare Cyberattacks Surge, Driving Higher Costs and Care '
'Disruptions',
'type': ['cyberattack', 'ransomware']}