Cyberattacks on U.S. Healthcare Organizations Increase, Disrupting Patient Care and Raising Costs

A new report by the Ponemon Institute and Proofpoint reveals that 97% of U.S. healthcare organizations experienced at least one cyberattack in the past year, with 74% of these incidents leading to disruptions in patient care. The average number of attacks rose to 51 in 2026 from 43 in 2025, and the average cost of the most expensive attack increased to $4.2 million. Operational disruption is now the largest cost category, averaging $1.39 million. Supply chain attacks were particularly impactful, disrupting care at 90% of affected organizations. The report also highlights concerns about AI adoption outpacing security governance, with 60% of organizations lacking controls for sensitive data used in AI systems. Data loss incidents also affected patient care, with over half of respondents reporting disruptions and 56% of that group noting increased mortality rates.