Proofpoint-Ponemon Institute research finds rising attack volumes, multimillion-dollar costs and growing AI-related data risks are putting healthcare operations under increasing pressure.
Cybersecurity incidents are increasingly becoming a direct threat to patient care, with nearly three in four US healthcare organisations reporting disruptions caused by cyberattacks, according to the fifth annual Cyber Insecurity in Healthcare report from Proofpoint and Ponemon Institute.
Based on responses from 705 IT and IT security practitioners, the study found that 97% of surveyed organisations experienced at least one cyberattack in the past 12 months. The average number of attacks rose to 51 per organisation, compared with 43 in 2025. The average cost of the most expensive incident climbed nearly 8% to $4.2 million.
The findings point to a growing operational challenge for healthcare providers: cyber incidents can affect not only data confidentiality and financial performance but also clinical schedules, hospital stays and medical outcomes.
“Cyber resilience has become essential to healthcare resilience,” said Ryan Kalember, chief strategy officer at Proofpoint. He added that healthcare organisations need security designed around the interactions between people, AI systems, sensitive data and clinical workflows.
“When a cyberattack delays a procedure, extends a hospital stay, or forces patients to another facility, cyber risk becomes patient risk.” — Ryan Kalember, Chief Strategy Officer, Proofpoint
Operational disruption is driving the cost of cyberattacks
The report identifies operational downtime and recovery as the largest cost category, averaging $1.39 million per organisation. Idle time and lost productivity added another $1.05 million, demonstrating how cyber incidents can continue to affect healthcare operations long after the initial compromise.
The consequences are particularly serious when clinical services depend on digital systems. Across the attack types studied—cloud and account compromise, ransomware, supply chain attacks and business email compromise—respondents reporting disruption cited increased complications from medical procedures, longer patient stays and delays in tests or procedures.
Supply chain attacks had the strongest reported impact on patient care: 90% of organisations experiencing these attacks said care was disrupted, up from 87% in 2025. Ransomware was associated with longer patient stays in 70% of affected organisations, while business email compromise was linked to delays in procedures and tests resulting in poor outcomes by 68% of respondents.
These findings highlight the importance of extending cybersecurity oversight beyond a hospital’s internal infrastructure to technology suppliers, service providers and other third parties that support clinical operations.
AI adoption is outpacing security governance
Artificial intelligence is introducing new risks as healthcare organisations integrate it into cybersecurity and patient-care activities. The study found that 45% of respondents had embedded AI in cybersecurity, patient care or both, while another 30% planned to adopt it.
However, governance and visibility remain uneven. Six in ten organisations lacked controls governing sensitive data used in AI systems. Only 42% had security measures specifically designed for AI systems, agents and generative AI, while just 32% had full visibility into employees’ use of unsanctioned AI tools.
Respondents identified supply chain risks from AI vendors, cited by 40%; data leakage through prompts, at 36%; and AI-generated phishing and social engineering, at 34%, as leading AI-related concerns. AI agents operating without appropriate guardrails were cited by 24% as a cause of data loss.
The challenge is not simply whether healthcare providers should adopt AI, but whether they can govern how these systems access, process and share sensitive information. As AI becomes embedded in clinical and administrative workflows, organisations need clear access controls, data-handling policies and visibility into the use of both approved and unauthorised tools.
Data loss can become a patient-safety issue
The report found that organisations experienced an average of 21 data-loss or exfiltration incidents involving sensitive healthcare information over two years. More than half—54%—said these incidents disrupted patient care. Among that group, 56% reported increased mortality rates.
Employee negligence remained the leading reported cause of data loss, while unguarded AI agents emerged as another contributing factor. The findings underline the need to address human behaviour, system permissions and data governance alongside conventional threat prevention.
Healthcare organisations also face growing exposure as they migrate clinical applications to cloud environments. The report found that 35% had moved clinical applications to the cloud, up from 30% in 2025, while another 44% planned to do so within two years. Yet cloud or account compromises disrupted patient care at 65% of organisations reporting such incidents.
As more clinical systems become accessible through cloud platforms, compromised accounts can provide a route to sensitive information and operational applications. Strong identity controls, appropriate access privileges and rapid detection of suspicious activity are therefore central to protecting continuity of care.
Fewer ransom payments, but disruption continues
The proportion of organisations experiencing ransomware that paid a ransom declined from 33% in 2025 to 31% in 2026. The average costliest ransom payment also fell, from $1.2 million to $1.1 million.
However, the clinical impact worsened. Seventy-two per cent of organisations experiencing ransomware reported disruption to patient care, compared with 67% in 2025. Among those reporting disruption, 70% cited longer patient stays.
The figures suggest that falling ransom payments do not necessarily translate into lower operational risk. Recovery costs, unavailable systems and delayed services can impose substantial burdens even when organisations refuse to pay attackers.
Resilience must extend beyond IT security
For healthcare leaders, the report’s central message is that cybersecurity should be treated as an operational and patient-safety priority, rather than solely a technology function. Preparedness requires coordinated action across IT, clinical leadership, data protection, procurement and third-party risk management.
Organisations need tested recovery plans, clear incident-response responsibilities, tighter controls over sensitive information and visibility into how employees and AI agents interact with clinical systems. Suppliers and cloud providers must also be included in resilience planning, given the reported impact of supply chain and account compromises.
The findings do not establish that every cyber incident results in patient harm. They do, however, show that care disruption is a recurring consequence among surveyed US healthcare organisations. With attack volumes and average incident costs rising, the ability to maintain or quickly restore essential services is becoming a critical measure of healthcare cyber resilience.
For hospitals, the stakes extend well beyond protecting networks and records. When digital systems underpin diagnosis, treatment and patient administration, securing those systems is inseparable from protecting the continuity and safety of care.
