Healthcare Data Breach Statistics 2026: Frequency, Costs & Top Causes

Introduction

From October 2026 through November 2026, the Inovo InfoSec research team analyzed HHS Office for Civil Rights (OCR) breach data from 2021 through August 2026, IBM’s Cost of a Data Breach Report 2026, Verizon’s 2026 Data Breach Investigations Report, and HIPAA Journal’s annual breach analyses to measure how often healthcare data breaches occur, how many patients they affect, what they cost, and what causes them.¹˒²˒⁷˒⁸˒¹³ OCR counts cover U.S. breaches affecting 500 or more people. The IBM and Verizon figures come from global studies.

Healthcare Data Breaches by Year, 2021 to 2026

Large healthcare breaches have stayed above 700 a year since 2021. Table 1 shows breach counts, people affected, small breach reports, and the largest breach for each year.

Table 1: Healthcare Data Breaches by Year, 2021 to 2026

Year	Large breaches (500+) reported to OCR	Individuals affected	Small breaches (under 500)	Largest breach of the year
2026 (Jan to Aug)	593¹	~78,600,000¹	Not yet published	DentaQuest, 15,000,000²
2025	807¹	~138,500,000²	Not yet published	Conduent Business Services, 62,224,658²
2024	742³	289,162,330³	74,299²	Change Healthcare, 192,700,000²
2023	745²	160,009,510⁴	68,315²	Welltok, 14,782,887²
2022	718²	~51,900,000⁵	63,966²	Independent Living Systems, 4,226,508²
2021	715²	~54,090,000⁵	63,571²	20/20 Eye Care Network, 4,142,440²

Note: OCR totals rise as breach investigations close. HIPAA Journal’s 2025 count went from 710 in February 2026 to 807 in October 2026.¹˒³ The 2021 to 2023 figures for individuals affected are earlier snapshots and likely understate current totals.

Key Takeaways

• In 2018, large breaches came in at about one a day. The 807 reported in 2025 work out to roughly 2.2 a day.¹˒²

• Change Healthcare alone exposed 192.7 million people in 2024, two-thirds of that year’s 289 million total. That total equals almost 85% of the U.S. population.²˒³

• Exposure dropped to about 138.5 million in 2025. Conduent’s 62.2 million-person breach still ranks third on the all-time list.²

• OCR received 74,299 reports of breaches under 500 people in 2024, about 100 for every large breach.²

• 2026 is running ahead of last year. Through August, breaches are up 6.7% and people affected are up 14.8% over the same period in 2025.¹

What Causes Healthcare Data Breaches

OCR assigns every large breach to one of five types. Table 2 breaks down 2025 breaches by type, with the people affected by each.

Table 2: Healthcare Data Breach Causes, 2025

Breach type (OCR category)	2025 breaches	Share of breaches	Individuals affected	Avg individuals per breach
Cyber Attack	648⁶	80.8%⁶	134,332,842⁶	207,304⁶
Unauthorized access / disclosure	142⁶	17.7%⁶	6,082,639⁶	42,835⁶
Theft	9⁶	1.1%⁶	44,417⁶	4,935⁶
Loss	2⁶	0.2%⁶	4,008⁶	2,004⁶
Improper disposal	1⁶	0.1%⁶	34,675⁶	34,675⁶

Note: Counts come from a full export of the OCR breach portal, which lists 802 breaches for 2025.⁶ The average column is our calculation (individuals affected divided by breaches).

Key Takeaways

• Cyber Attack accounted for 81% of 2025 breaches and 96% of the people affected.⁶

• The average hacking breach exposed about 207,000 people. That is nearly five times the average for an unauthorized access or disclosure incident.⁶

• Unauthorized access and disclosure rose 17.4% in 2025. Insider snooping, misdirected records, and website tracking tools drove the increase. Through August 2026, the category is down 21.2%.¹˒³

• In 61.5% of 2025 breaches, the exposed data sat on network servers. Email came next at 24.9%.³

• Theft and loss once led the breach reports. In 2025 they produced 11 large breaches combined.²˒⁶

How Attackers Get Into Healthcare Organizations

Most breaches are hacks, so the next question is how attackers get in. In Verizon’s 2026 data, exploited vulnerabilities are the leading entry point for healthcare breaches.

Table 3: How Attackers Get In: Healthcare Breach Vectors

Factor	Share of healthcare breaches
Vulnerability exploitation (initial access)	20%⁷
Phishing (initial access)	14%⁷
Stolen credentials (initial access)	11%⁷
Employee error (initial access)	11%⁷
External threat actors	81%⁷
Internal threat actors	19%⁷
Human element involved	54%⁷ (share of incidents)
Third party involved	32%⁷

Note: Figures come from Verizon’s 2026 Data Breach Investigations Report, as summarized by HIPAA Journal (1,492 healthcare incidents, 1,438 confirmed breaches).⁷

Key Takeaways

• Exploited vulnerabilities led at 20%. Phishing followed at 14%, with stolen credentials and employee error at 11% each.⁷

• Verizon found that only 26% of critical vulnerabilities were fully fixed in 2025. The median fix took 43 days.⁷

• External actors were behind 81% of healthcare breaches and insiders behind 19%.⁷

• The human element played a role in 54% of healthcare incidents. Misdelivery was the most common human-related cause, at about 40%.⁷

• Around 32% of healthcare breaches involved a third party, such as a vendor or business associate.⁷

Average Cost of a Healthcare Data Breach

IBM tracks breach costs by industry every year. Table 3 compares the healthcare average with the global average across all industries.

Table 4: Average Cost of a Healthcare Data Breach, 2023 to 2026

IBM report year	Healthcare avg cost	Global avg cost (all industries)	Healthcare premium over global
2026	$6.64M⁸	$4.99M⁸	1.33x⁸
2025	$7.42M¹⁰	$4.44M⁹	1.67x⁹˒¹⁰
2024	$9.77M¹⁰	$4.88M⁹	2.00x⁹˒¹⁰
2023	$10.93M¹¹	$4.45M¹¹	2.46x¹¹

Note: The premium column is our calculation (healthcare average divided by global average).

Key Takeaways

• At $6.64 million, healthcare still has the highest average breach cost of any industry. Financial services is second at $6.29 million.⁸

• The healthcare average is down 39% from its 2023 peak of $10.93 million. In 2023, a healthcare breach cost 2.46 times the global average; in 2026, 1.33 times.⁸˒¹¹

• U.S. breaches across all industries averaged $11.5 million in 2026, more than double the global average.¹² For U.S. healthcare organizations, the global healthcare figure is best read as a floor.

• In IBM’s 2025 study, healthcare breaches took 279 days to find and contain. That was five weeks longer than the global average.¹⁰

• OCR imposed 21 HIPAA penalties in 2025, totaling $8.33 million. 76% of them cited a failed risk analysis.²˒³

The Largest Healthcare Data Breaches of 2025 and 2026

Table 4 lists the 10 largest healthcare breaches reported since January 2025. Five happened at business associates, not hospitals or health plans.

Table 5: Largest Healthcare Data Breaches, 2025 to 2026

Organization	Year	Entity type	Individuals affected	Breach type
Conduent Business Services	2025	Business associate	62,224,658²	Hacking / IT
DentaQuest	2026	Health plan	15,000,000²	Hacking / IT
Aflac	2025	Health plan	13,924,906²	Hacking / IT
Aesto	2026	Business associate	9,540,683²	Hacking / IT
Episource	2025	Business associate	6,725,572²	Hacking / IT
Lumexa Imaging	2026	Healthcare provider	5,830,949²	Hacking / IT
Yale New Haven Health System	2025	Healthcare provider	5,556,702²	Hacking / IT
Blue Shield of California	2025	Business associate	4,700,000²	Unauthorized disclosure (website tracking tools)
AdaptHealth	2026	Healthcare provider	4,115,802²	Hacking / IT
Unlimited Technology Systems	2026	Business associate	3,803,750²	Hacking / IT

Key Takeaways

• Nine of the 10 were hacking incidents. Blue Shield of California is the exception: its 4.7 million-person breach came from website tracking tools.²

• Business associates accounted for 35.8% of all large breaches in 2025. Healthcare providers accounted for 57.5% and health plans for 6.5%.³

• A single vendor breach can expose patient data from dozens of covered entities. Verizon found third parties in about 32% of healthcare breaches.⁷

What These Numbers Mean for Healthcare Leaders

Breach counts are holding near record levels. Costs remain the highest of any industry, and unpatched systems and vendors account for a large share of the exposure. Regulators have noticed. OCR’s hacking investigations now center on whether an organization completed a HIPAA risk analysis, and in 2026 that focus is expanding to risk management.²

Knowing where your own gaps sit is the practical first step. Inovo InfoSec’s CISO-led Security Maturity Level Assessment maps an organization’s controls against HIPAA and HITRUST, ranks the gaps by risk, and builds a remediation roadmap and budget. To see how your controls compare, contact us.

References

1.        HIPAA Journal. “August 2026 Healthcare Data Breach Report.” October 30, 2026. https://www.hipaajournal.com/august-2026-healthcare-data-breach-report/

2.        HIPAA Journal. “Healthcare Data Breach Statistics.” Updated October 15, 2026. https://www.hipaajournal.com/healthcare-data-breach-statistics/

3.        HIPAA Journal. “2025 Healthcare Data Breach Report.” February 13, 2026. https://www.hipaajournal.com/2025-healthcare-data-breach-report/

4.        HIPAA Journal. “Welltok Data Breach Victim Count Rises to 14.76 Million.” August 23, 2024. https://www.hipaajournal.com/welltok-data-breach/

5.        HIPAA Journal. “2022 Healthcare Data Breach Report.” January 2023. https://www.hipaajournal.com/healthcare-data-breaches-2022/

6.        The Uptime Report. “Healthcare Data Breach Report 2026: 802 Breaches, 140 Million People, and the Vendor Problem.” October 2026. https://theuptimereport.com/healthcare-data-breach-report-2026/

7.        HIPAA Journal. “Verizon: Healthcare Sector Facing Sustained, Multi-vector Attacks.” May 20, 2026. https://www.hipaajournal.com/verizon-dbir-2026-healthcare/

8.        Becker’s Hospital Review. “Healthcare data breaches cost $6.64M on average: Report.” July 31, 2026. https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/healthcare-data-breaches-cost-6-64m-on-average-report/

9.        IBM. “2025 Cost of a Data Breach Report: Navigating the AI rush without sidelining security.” July 30, 2025. https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai

10. HIPAA Journal. “Average Cost of a Healthcare Data Breach Falls to $7.42 Million.” July 30, 2025. https://www.hipaajournal.com/average-cost-of-a-healthcare-data-breach-2025/

11. IBM Security. “Cost of a Data Breach Report 2023.” July 2023. https://ibm.com/downloads/cas/E3G5JMBP

12. eSecurity Planet. “IBM 2026 Cost of a Data Breach Report: Key Findings.” July 30, 2026. https://www.esecurityplanet.com/cybersecurity/ibm-2026-cost-of-a-data-breach-report-key-findings/

13. U.S. Department of Health and Human Services, Office for Civil Rights. “Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information.” https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf