Cyberattacks disrupted patient care at 74% of US healthcare organizations in the past year, according to the fifth annual Cyber Insecurity in Healthcare report released by Proofpoint and Ponemon Institute on October 13, 2026. The study, based on responses from 705 IT and IT security practitioners at US healthcare organizations, found that 97% of organizations experienced at least one cyberattack in the previous 12 months.
The Headline Findings
- Attack volume is climbing: organizations faced an average of 51 cyberattacks, up from 43 in 2025.
- Costs are climbing with it: the average cost of an organization's most expensive attack rose nearly 8%, from $3.9 million in 2025 to $4.2 million in 2026.
- Operational disruption is the single largest cost category, averaging $1.39 million, ahead of $1.05 million from idle time and lost productivity.
- Across the attack types studied, respondents who reported care disruption cited more complications from medical procedures (an average of 53%), longer patient stays (52%) and delays in tests or procedures (52%).
- Organizations reported an average of 21 data loss or exfiltration incidents involving sensitive healthcare information over two years. 54% said those incidents disrupted patient care.
AI Adoption Is Outpacing Governance
The report gives particular attention to AI. It found 45% of organizations have embedded AI in cybersecurity or in both cybersecurity and patient care, with another 30% planning to adopt it. Governance has not kept pace: 60% of organizations lack controls governing the sensitive data used in AI systems, only 42% use security measures designed specifically for AI systems and agents, and just 32% have full visibility into employees' use of unsanctioned AI tools.
The risk is already materializing. AI agents operating without guardrails were cited by 24% of respondents as a cause of data loss, and organizations named supply chain risk from AI vendors (40%), data leakage through prompts (36%) and AI-generated phishing and social engineering (34%) as their leading AI-specific concerns.
Ransomware and Supply Chain Attacks
Supply chain attacks had the greatest impact on patient care of the attack types studied: 90% of organizations that experienced them reported care disruption, up from 87% in 2025. Ransomware disrupted care at 72% of organizations that experienced it, up from 67% in 2025, and was most associated with longer patient stays. Fewer organizations are paying ransoms, however: 31% of those hit by ransomware paid, down from 33%, and the average costliest ransom payment fell from $1.2 million to $1.1 million.
The report also links rising risk to cloud migration. 35% of organizations have moved clinical applications to the cloud, up from 30% in 2025, and cloud or account compromises disrupted patient care for 65% of respondents who experienced them.
What This Means for Hospital Security Planning
The respondents in this study are drawn from across US healthcare, and the pattern it documents, more attacks, more clinical disruption, and disruption rather than ransom payments driving the cost, applies to mid-sized hospitals and multi-location clinic groups as much as to large systems. Care disruption is the metric boards and practice owners should focus on: delayed procedures, longer stays and diverted patients are patient-safety and revenue events, not IT inconveniences. Proofpoint's chief strategy officer, Ryan Kalember, made the same point in the release, arguing that when an attack delays a procedure or extends a stay, cyber risk becomes patient risk.
Analysis: The Governance Gap Is the Actionable Finding
Analysis (Med Clinic X): The attack statistics will get the headlines, but the finding healthcare leaders can act on immediately is the governance gap around AI. Clinics are adopting AI reception, intake and documentation tools faster than they are writing rules for what data those tools may touch. Before any AI tool is connected to patient data, a practice should be able to answer three questions: what data the vendor can access, whether a Business Associate Agreement covers it, and who inside the practice owns monitoring. Our evergreen guide walks through the evaluation criteria in detail: https://medclinicx.com/blog/healthcare-cybersecurity-software-guide
Sources and References
- Proofpoint, Inc., Healthcare Sees No Relief from Cyberattacks Disrupting Patient Care (Cyber Insecurity in Healthcare report announcement), October 13, 2026: https://www.proofpoint.com/us/newsroom/press-releases/cyber-insecurity-in-healthcare-report-2026
- GlobeNewswire, Healthcare Sees No Relief from Cyberattacks Disrupting Patient Care, October 13, 2026: https://www.globenewswire.com/news-release/2026/10/13/3379461/35374/en/healthcare-sees-no-relief-from-cyberattacks-disrupting-patient-care.html
- CXO Today, Proofpoint-Ponemon 2026 Audit: 74% of Healthcare Cyberattacks Directly Disrupt Patient Care, October 14, 2026: https://cxotoday.com/cybersecurity/proofpoint-ponemon-2026-audit-74-of-healthcare-cyberattacks-directly-disrupt-patient-care/
Reporting based on the sources above, accessed October 15, 2026. Med Clinic X did not conduct original reporting or interviews for this article. Corrections: contact us via https://medclinicx.com/contact