Healthcare Cyberattacks Surge in Frequency and Cost, AI Poses New Risks
A new study reveals a significant increase in the frequency and cost of cyberattacks targeting the healthcare sector, with AI adoption outpacing security measures and disrupting patient care.
Cyberattacks targeting healthcare organizations are becoming more frequent, costly, and disruptive to patient care, according to a new study by the Ponemon Institute and Proofpoint. The research, which surveyed 705 IT and security practitioners at U.S. healthcare institutions in May 2026, found that nearly all organizations experienced at least one cyberattack in the past year.
Operational disruption expenses, stemming from system unavailability, now represent the largest cost associated with these attacks, averaging $1.39 million. This figure is an increase from the previous year's average of $1.2 million. "When critical systems go down, the consequences extend well beyond financial losses to delayed procedures, longer hospital stays and interruptions in essential patient services," said Susan Biddle, director of healthcare solutions at Proofpoint. The study reported that 97% of respondents experienced at least one cyberattack in the last 12 months, with 74% noting disruptions to patient care. The average number of attacks also rose to 51 from 43 in 2025.
The average cost of the most expensive cyberattack climbed nearly 8% to $4.2 million, up from $3.9 million in 2025. Biddle emphasized that these incidents are increasingly becoming "healthcare operational crises, not just IT incidents." While fewer organizations are paying extortion demands, the report cautions that avoiding a ransom payment does not necessarily negate the broader consequences of an attack. The focus is shifting from merely stopping attacks to ensuring that clinicians can continue their work and patients can receive care.
Compounding these challenges, the healthcare sector is rapidly adopting artificial intelligence technologies, often before adequate security and governance measures are in place. The survey revealed that 45% of organizations have embedded AI in cybersecurity or in both cybersecurity and patient care, with an additional 30% planning to do so. However, a significant 60% of respondents admitted their organizations lack controls governing sensitive data used in AI systems, and only 42% employ security measures specifically designed for AI.
Concerns regarding AI-specific risks are mounting. Nearly 40% of survey respondents identified supply chain risk from AI vendors as their greatest concern. Other significant worries include data leakage via prompts, AI-generated phishing and social engineering scams, inadequate privacy protections, and the use of non-compliant AI tools. "AI technologies hold enormous promise for improving care and efficiency, but many organizations still lack the visibility and governance needed to manage the risks," Biddle stated.
To address these evolving threats, Biddle advises that security measures must evolve alongside AI adoption. This requires a clear understanding of where AI is being used, what sensitive information it can access, and the actions AI agents are permitted to take. Prioritizing the governance of sensitive data within AI systems is crucial as AI becomes more integrated into clinical and operational workflows.
Beyond AI-related risks, the report also highlights the persistent threat of human-factor vulnerabilities, including phishing, compromised accounts, and employee errors. As human and AI agents increasingly collaborate, protecting these interactions while ensuring the continuity of critical healthcare services remains a paramount concern. The findings align with broader industry discussions about shifting from cyber defense to cyber resilience, a concept deemed even more critical for the healthcare sector where patient care cannot be interrupted.
The study underscores a critical juncture for healthcare cybersecurity, where the increasing sophistication of threats, coupled with the rapid, often unsecured, adoption of new technologies like AI, demands a proactive and comprehensive approach to security and resilience.