Healthcare Data Breach Statistics 2026: What 8,000+ HHS Breach Reports Show

Healthcare data breaches in 2026 so far

From January 1 to October 15, 2026, hospitals, doctors, health plans and their vendors reported 622 breaches of 500 or more records to HHS. Together they affected 87,703,854 people, or rather, that many notifications: someone caught in three breaches counts three times.

Compared with the same period of 2025, that is 5% fewer breaches and 36% fewer people affected.

Don’t read too much into the drop. The number of people affected swings with a few giant breaches. 2024 looks terrible because of Change Healthcare alone, 2025 because of Conduent. The count of breaches is the steadier measure, and it has stayed between about 560 and 660 for the first nine and a half months of every year since 2021. What has changed is the share caused by hacking, now 86%.

The 2026 figures will still grow. HHS posts reports weeks after they are filed, and organizations often file a placeholder number first and correct it later. Lumexa Imaging first reported 2,994 affected people; its entry now says 5,830,949.

Most breaches are small. The median 2026 breach affected 4,402 people, and two in three affected fewer than 10,000. The ten largest account for 68% of all people affected this year.

The biggest healthcare data breaches of 2026

Sixteen breaches reported in 2026 affected a million people or more. Four of the ten largest happened at vendors rather than at the hospitals or insurers patients actually deal with.

DentaQuest is the largest. The Massachusetts company, owned by Sun Life, administers dental benefits for Medicaid and CHIP programs. Someone was inside its network from May 17 to May 20, 2026, and took names, addresses, Social Security numbers, Medicaid and Medicare numbers and dental treatment details (HIPAA Journal). The extortion group ShinyHunters claimed the attack and leaked the data. The official count is 15 million, but a researcher who analyzed the leak found more than 23 million unique name and birth date combinations, so the final number may be higher.

Aesto Health, a Birmingham, Alabama, company that migrates and archives old electronic health records, found an intruder in part of its Amazon Web Services environment in December 2025. It needed until May 2026 to confirm that patient data was involved. At least 39 healthcare providers that used Aesto had patients in the stolen files (HIPAA Journal).

iRhythm Technologies, the maker of the Zio heart monitor, told the SEC in June that attackers got data from business applications hosted by a third party “through social engineering” and then demanded payment (SEC filing). No group has claimed it.

Lumexa Imaging, which runs administrative services for radiology practices, lost patient files through one of its own vendors in April (notice filed in Nebraska). AdaptHealth, a home medical equipment supplier, was breached in June after attackers talked their way into a contractor’s privileged session and from there into cloud apps and patient portals (BleepingComputer).

Two of the five largest, iRhythm and AdaptHealth, started with social engineering: someone tricked a person instead of breaking software.

Healthcare data breaches by year, 2009–2026

2025 had the most large healthcare data breaches on record: 811. That is more than two a day, and more than double the 2014 figure.

The number of people affected peaked in 2024 at 290 million, because the Change Healthcare ransomware attack alone affected 192.7 million. In 2025 the total was 141.7 million.

Since HHS started publishing the list in 2009, the reports add up to 1.1 billion affected records. That is more than three for every person living in the United States (341.8 million, Census Bureau estimate for 2025). Since 2020 alone, the total is 864 million.

Two of the three largest breaches ever reported to HHS hit companies that most patients never deal with directly:

• Change Healthcare (2024): 192.7 million people. The UnitedHealth unit processes insurance claims and payments. UnitedHealth put the cost of the attack at $3.09 billion for 2024 (Becker’s).
• Anthem (2015): 78.8 million people.
• Conduent Business Services (2025): 62.2 million people. The government and health plan contractor was hacked between October 2024 and January 2025 (BankInfoSecurity). Early state filings mentioned 10.5 million. In October 2026 Conduent agreed to an $80 million class action settlement, pending court approval (SEC filing).

DentaQuest’s 15 million makes it the fourth-largest breach on the list.

How healthcare data breaches happen

In 2010, hacking caused 4% of large healthcare breaches. Most were stolen laptops and other devices, lost files and paper. In 2026, hacking or another IT incident caused 86% of breaches and 98% of affected records.

Where the data sat tells the same story. In 2026, 72% of breaches involved a network server, 20% email accounts and only 4% paper or film. Most of the rest, 85 breaches, were “unauthorized access or disclosure”, which covers anything from a staff member snooping in records to letters sent to the wrong address. Theft and loss together caused three.

Verizon’s 2026 Data Breach Investigations Report, which counts breaches worldwide, found 1,438 confirmed healthcare breaches in its data. Attackers most often got in by exploiting a software vulnerability (20%), then by phishing (14%) and stolen credentials (11%). Insiders were behind 19% of breaches, down from 30% a year earlier. A human element, such as a mistake or someone falling for a scam, played a part in 54%.

Vendors: a third of breaches, most of the records

Hospitals and insurers share patient data with dozens of companies: billing firms, claims processors, IT providers, software vendors. HIPAA calls them business associates. When one of them is breached, the data of many healthcare organizations’ patients goes at once.

Vendors were involved in 30–40% of breaches every year since 2020, but often in most of the affected records. In 2024 the share was 78%, in 2025 64%.

In 2026 the vendor share of people affected is lower so far, at 39%, mostly because the largest breach of the year (DentaQuest) was filed by DentaQuest itself, as a health plan. Aesto, Unlimited Technology Systems, CareCloud and TriZetto, all among the ten largest, are vendors.

Verizon found a third party involved in 32% of healthcare breaches. For patients this is the uncomfortable part: you can choose your doctor, but not your doctor’s billing company. Most people learn its name from the breach letter.

Ransomware and patient care

In 2025, healthcare was the critical infrastructure sector that reported the most ransomware attacks to the FBI: 460 complaints, ahead of critical manufacturing (355) and financial services (258). A year earlier it was 238. Healthcare organizations also filed 182 data breach complaints (FBI IC3 2025 report). These are only the attacks victims chose to report.

Cyberattacks hit patients directly when they shut down hospital systems. In 2026:

• University of Mississippi Medical Center: an attack on February 19 took down its electronic health records, closed clinics across the state and cancelled surgeries. Clinics reopened on March 2. The Medusa ransomware group claimed it (TechTarget, Comparitech).
• Signature Healthcare Brockton Hospital, Massachusetts: after a cyberattack on April 6, ambulances were diverted, records went offline and chemotherapy was cancelled the next day. The Anubis ransomware group claimed it (HIPAA Journal).
• UNM Health, New Mexico’s only Level 1 trauma center: a cyberattack on October 26 made it divert ambulances for two hours and cancel appointments and outpatient surgeries; systems were back the next day (HIPAA Journal).

The harm can be measured. A study of ransomware attacks on US hospitals, published in the American Economic Journal: Economic Policy in 2026, found that hospital volume fell by 17–24% in the week of the attack. Among patients already admitted when an attack began, in-hospital mortality rose by 34–38% (Neprash, McGlave and Nikpay). Nearby hospitals feel it too: when a San Diego health system was hit in 2021, ambulance arrivals at neighboring emergency departments rose by 35% and stroke code activations went from 59 to 103 (JAMA Network Open, 2023).

In the UK, King’s College Hospital confirmed in 2025 that the 2024 ransomware attack on its pathology provider Synnovis contributed to a patient’s death (The Register).

Healthcare data breaches by state

California and Texas report the most breaches, which mostly reflects their size. The table counts breaches by the state where the reporting organization is based. Patients can live anywhere: a Massachusetts-based DentaQuest breach affects Medicaid members across many states.

Our dataset has the state for every report since 2009.

What a healthcare data breach costs

Healthcare is the most expensive industry for data breaches for the 13th year running. IBM’s Cost of a Data Breach Report 2026 puts the average healthcare breach at $6.64 million, down from $7.42 million in 2025 and $9.77 million in 2024. The average across all industries is $4.99 million (IBM). IBM surveyed 602 organizations worldwide that were breached between March 2025 and February 2026.

The largest cases cost far more. UnitedHealth booked $3.09 billion for the Change Healthcare attack in 2024 alone. Conduent’s $80 million settlement covers about 62 million people, about $1.29 per person, and the lawyers’ fees come out of that.

Class actions followed four of the five largest 2026 breaches: DentaQuest faces at least six proposed class actions, Aesto three, Lumexa three and AdaptHealth one (BenefitsPRO, Paubox, Law360, Law360).

HIPAA fines and enforcement

HHS’s Office for Civil Rights (OCR), which enforces HIPAA, announced 21 enforcement actions in 2025, worth $8.33 million together. In 2026 so far it has announced 12, worth $3.97 million. The largest of 2025 was a $3 million settlement with Solara Medical Supplies over a phishing attack. The largest of 2026 is $800,000 from Lehigh Valley Health Network, whose stolen records, including photos of cancer patients, were published on the dark web (HHS).

The amounts are small next to the breaches. MMG Fusion, a dental patient communication software company, paid $10,000 over a 2020 breach that affected about 15 million people (HHS). That is less than a tenth of a cent per person.

Many of the cases come from OCR’s Risk Analysis Initiative, launched in late 2024, which goes after organizations that never properly assessed the risks to the patient data they hold. OCR’s director, Paula Stannard, said in October that “the best defense against cyberattacks is full implementation of the HIPAA Security Rule.”

The Security Rule dates from 2003. In January 2025, HHS proposed a major update that would make multi-factor authentication and encryption mandatory (Hunton). It has since moved to the government’s list of long-term actions, with a final rule now expected no earlier than July 2027 (reginfo.gov).

State attorneys general also enforce. In 2026, 44 states settled with Labcorp for $2.29 million over a 2019 vendor breach (NAAG), and New York and Connecticut got $2.64 million (plus $1.3 million suspended) from Boston Children’s Health Physicians and its IT vendor XTIUM over a 2024 breach of about 888,000 people (New York AG).

Since February 16, 2026, OCR also accepts breach reports for addiction treatment records protected by 42 CFR Part 2 (HHS). Its new public list of such breaches was still empty on November 9, 2026.

Healthcare data breaches and fines outside the US

There is no European equivalent of the HHS list, so the best public record is what regulators fine. Our GDPR fines tracker holds 3,094 fines. 238 of them, worth €34.1 million, went to healthcare organizations: hospitals, clinics, doctors, pharmacies, labs, health insurers, health authorities and health data companies.

2026 is already the biggest year, with 27 healthcare fines worth €14.1 million. Two decisions about the same company make up most of it: IQVIA, which collects prescription and patient data for pharmaceutical research, was fined €5 million in France and €7 million in Italy.

Italy has issued the most healthcare fines (90), mostly against regional health authorities and hospitals, followed by Spain (26) and Germany (21). 67 of the healthcare fines, more than one in four, were for weak security, the closest equivalent to a US breach case.

Large breaches outside the US in 2025 and 2026 include:

• France: attackers got into MonLogicielMedical, practice software from Cegedim Santé used by about 3,800 doctors, in late 2025. Its database holds records of nearly 15 million patients; mostly administrative data was exposed, and doctors’ notes on 160,000–170,000 patients may have been accessed. Paris prosecutors are investigating (Siècle Digital).
• Netherlands: a ransomware group stole cervical cancer screening results of at least 715,000 women from the lab Clinical Diagnostics in July 2025, along with their names, addresses and citizen service numbers (NL Times).
• France: the CNIL fined Hôpital privé de la Loire €500,000 in 2026 after an attacker used one external user’s login, without multi-factor authentication, to take data on 524,867 patients (CNIL).
• Australia: a court ordered Australian Clinical Labs to pay A$5.8 million in October 2025, the first civil penalty ever under Australia’s Privacy Act, for a 2022 breach of more than 223,000 people (OAIC).

What to do if your health data was in a breach

A breach letter usually arrives months after the attack. It tells you what was taken, and that decides what is worth doing.

• Check the letter is real. Scammers send fake breach notices. Look the organization up on the HHS breach portal or its own website, and call a number you found yourself, not the one in an email.
• If your Social Security number was taken, freeze your credit at Equifax, Experian and TransUnion. It’s free and stops anyone opening new credit in your name (FTC). Also consider an IRS Identity Protection PIN, which blocks someone else from filing a tax return with your number.
• Take the free credit monitoring if it’s offered. It costs you nothing, though it only tells you about fraud after the fact.
• Read your insurance statements (explanation of benefits). Treatments, prescriptions or visits you don’t recognize are a sign of medical identity theft. Report them to your insurer and provider, and at IdentityTheft.gov (FTC guide, PDF).
• Expect better phishing. Stolen health data makes scams convincing: a caller who knows your doctor, your diagnosis or your insurance ID is not proof of anything.

You can change a password after a breach. You can’t change a diagnosis.

Methodology, sources and how to cite this page

HHS breach reports. We downloaded both lists from the HHS Office for Civil Rights breach portal on November 9, 2026: the reports under investigation (730) and the archive (7,347), 8,077 in all, filed between October 21, 2009 and October 15, 2026. The portal lists breaches of unsecured protected health information affecting 500 or more people, reported by HIPAA-covered entities (healthcare providers, health plans, clearinghouses) and their business associates. Breaches of health apps and other companies not covered by HIPAA are not included.

Counting. We count a breach in the year it was first reported to HHS (the “breach submission date”), not the year it happened. “People affected” is the latest number on the portal; it counts notifications, so a person affected by several breaches is counted several times. “Vendor involved” means the reporting entity is a business associate or the report says a business associate was involved. The state is where the reporting organization is based. Figures for 2026 are incomplete and may change as HHS posts late reports and corrected counts.

Other sources. FBI IC3 Internet Crime Report 2025; IBM Cost of a Data Breach Report 2026; Verizon 2026 Data Breach Investigations Report (healthcare snapshot); HHS press releases on HIPAA enforcement (counted by announcement date); company notices, SEC filings and state attorney general filings for individual breaches.

GDPR fines. Our GDPR fines tracker, 3,094 fines as of November 9, 2026. We classified a fine as healthcare when the fined organization’s main business is healthcare or health data, matching organization names and decision summaries and reviewing every match by hand.

Download: our dataset (CSV) with all 8,077 HHS breach reports, cleaned, with the date in ISO format and a vendor-involved column. Free to use with credit to PrivacyAffairs.