Healthcare Cybersecurity Statistics

Breaches of 500+ records reported to OCR in 2024 — the third consecutive year above 700.

Individuals' records breached in 2024 — a 63.5% increase over 2023, driven largely by the Change Healthcare breach (~190M records).

Of 2024 breaches were hacking/IT incidents (589 of 725), affecting 259M+ records — by far the dominant breach type.

Share of 2024 breaches from unauthorized access/disclosure, loss/theft, and improper disposal, respectively.

Median breach size in 2024, by records affected. 61% of all reported breaches involved fewer than 10,000 records — most breaches are small, even though headlines focus on the largest ones.

Share of 2024 breaches reported by healthcare providers, business associates, and health plans, respectively.

Average cost of a U.S. healthcare data breach in 2025 — down from $9.77M in 2024, but still the most expensive industry studied.

Average time to identify and contain a healthcare data breach — longer than the cross-industry average, meaning more time for exposed data to be exploited before anyone notices.

Average cost of a breach in the U.S. financial sector in 2025 — the second most expensive industry, well behind healthcare.

Average cost of a data breach across all U.S. industries in 2025 — a record high, up from $9.36M in 2024.

Global average cost of a data breach across all industries and countries in 2025 — down about 9% from $4.88M in 2024.

Security incidents tracked at healthcare organizations in the 2025 DBIR dataset, with 1,542 confirmed data disclosures.

Share of healthcare breach actors that were external, internal, and partner, respectively (plus 1% involving multiple actor types).

Of healthcare attacks were financially motivated. 16% involved an espionage motive — a sharp jump from just 1% the year before.

Overtook miscellaneous errors as the leading breach pattern in healthcare in 2024, as attacker-driven incidents rose and accidental-exposure incidents declined.

Of breaches across all industries Verizon studied involved ransomware — up sharply from 32% the year before. 64% of ransomware victims did not pay.

Cross-industry figure, not healthcare-specific — Verizon's healthcare snapshot does not break out a separate ransomware percentage.

HIPAA enforcement actions with financial penalties in 2024, totaling $12,841,796 — among the most active years on record for OCR enforcement.

Cumulative HIPAA settlements and civil money penalties since the Privacy Rule took effect in April 2003, totaling $144,878,972, as of OCR's October 31, 2024 snapshot.

HIPAA complaints received by OCR since April 2003, with 99% of cases resolved to date.

The largest HIPAA settlement ever paid: Anthem, in 2018, tied to a 2015 breach that affected 79 million individuals — still the record-holder years later.

The two largest 2025 HIPAA penalties: Solara Medical Supplies ($3M) and a civil monetary penalty against Warby Parker ($1.5M, Feb. 2025).

Enforcement actions brought under OCR's Right of Access Initiative to date — one of OCR's most actively enforced initiatives, alongside a newer Risk Analysis Initiative launched in late 2024.