Healthcare Data Breach Statistics 2026: 506 Breaches, 74.9M Affected & 804 in 2025

What the OCR Breach Portal Measures

The OCR portal is one of the strongest datasets for studying U.S. healthcare breach reporting, but it is not a census of every healthcare cybersecurity incident. It records regulatory breach reports submitted under HIPAA requirements, and the values can change as investigations progress.

For breaches affecting at least 500 individuals, HHS requires notification without unreasonable delay and no later than 60 calendar days after discovery. If an organization does not yet know the final affected population, HHS permits an estimate and requires the report to be supplemented when additional information becomes available.

Affected Individuals Are Not the Same as Records Exposed

OCR frames its reporting threshold around the number of individuals affected. An OCR aggregate of 140.5 million should therefore be described as approximately 140.5 million affected individuals listed across the relevant breach filings.

It should not automatically become “140.5 million medical records stolen.” A patient may have multiple medical, billing or insurance records. Annual aggregates also do not necessarily represent the same number of unique Americans because an individual could theoretically appear in more than one unrelated breach.

Submission Year and Occurrence Year Are Different Measurements

HHS’s 2024 Annual Report to Congress recorded 663 large breaches that occurred or ended during 2024, affecting approximately 242.9 million individuals. OCR nevertheless received 742 large-breach reports through the web portal during calendar 2024 because some submitted reports related to incidents from other periods.

• Reports received during a calendar year measure regulatory submissions.
• Breaches occurring or ending during a calendar year measure incident timing.
• The live register can change when entries are added or amended.

For that reason, this research uses explicit descriptions such as “filings submitted in 2025” rather than presenting every portal-derived total as breaches that occurred in 2025.

Breaches Affecting Fewer Than 500 Individuals Are Mostly Missing From the Public Wall

The public OCR breach portal focuses on incidents affecting 500 or more individuals, but HIPAA reporting does not stop at that threshold. HHS’s 2024 Report to Congress says OCR received 74,299 reports of breaches affecting fewer than 500 individuals that occurred or ended in 2024. Together, those smaller incidents affected 340,618 individuals.

HHS says unauthorized access or disclosure was the most frequently reported category among those smaller breaches. The scale difference is important: the public 500+ dataset is useful for analyzing large incidents, but it does not represent the full number of HIPAA breach reports received by OCR.

The Median 2025 Large Breach Affected 4,824 Individuals

The 2025 OCR-derived register has a median filing size of 4,824 affected individuals. That median is far below the year’s overall average because a small number of mega-breaches — especially Conduent’s 62.2 million-person filing — pull the aggregate sharply upward.

This is why annual totals alone can give a misleading impression of a “typical” healthcare breach. The distribution contains hundreds of incidents affecting thousands of people alongside a small number affecting millions.

Why 2024 Was Such an Extreme Year

The Change Healthcare incident dominated the 2024 affected-person total. HHS says Change Healthcare eventually informed OCR that approximately 192.7 million individuals had been impacted.

That one breach represented most of the roughly 242.9 million affected individuals in HHS’s occurrence-year 2024 report. This illustrates why event frequency and human impact can move differently.

A year with fewer breach events can produce a much larger affected population when one or two highly concentrated service providers are compromised.

Why 2025 Had More Filings but Fewer Affected Individuals

The September 4, 2026 snapshot contains 804 filings submitted in 2025, above the 741 filings listed for 2024, yet the affected-person total fell to approximately 140.6 million.

That does not demonstrate that healthcare became safe in 2025. It mainly shows that the year’s filings did not contain another incident on the scale of Change Healthcare. Conduent alone accounts for more than 62 million affected individuals in the 2025 register, while Aflac, Episource and several large healthcare systems added millions more.

Hacking and IT Incidents Dominate OCR Filings

In the current 2025 register:

• 651 filings, or 81%, were classified as Hacking/IT Incident;
• 141, or 18%, as Unauthorized Access/Disclosure;
• nine as Theft;
• two as Loss; and
• one as Improper Disposal.

“Hacking/IT Incident,” however, is a broad regulatory category. It should not be translated into “ransomware” without incident-level evidence.

Verizon Shows How Attackers Get In

Verizon’s 2026 healthcare analysis covers 1,492 incidents and 1,438 breaches with confirmed data disclosure. The top three healthcare patterns — System Intrusion, Miscellaneous Errors and Social Engineering — collectively represented 81% of breaches in its dataset.

For initial access, Verizon reported:

• 20% vulnerability exploitation;
• 14% phishing; and
• 11% credential abuse.

These values come from Verizon’s healthcare corpus, not the OCR breach portal. For broader exploitation trends, see ScanTitan’s vulnerability statistics, while broader social-engineering trends are covered in our phishing statistics research.

Human Error Has Not Disappeared

Verizon found a 54% human element in healthcare breaches and described Miscellaneous Errors as a persistent healthcare pattern. Its leading error types included misdelivery, loss and misconfiguration.

Healthcare breach analysis therefore needs to account for both malicious intrusion and non-malicious exposure, including:

• misdelivery;
• incorrect access;
• unsafe data flows;
• exposed storage;
• tracking or analytics misconfiguration; and
• loss of unencrypted devices or media.

Where Breached Healthcare Information Was Located in 2025

The OCR-derived 2025 register also records the location of breached information. Because a filing can list more than one location, these categories are multi-valued and the shares can sum to more than 100%.

Network servers were therefore recorded far more often than any other location in the 2025 submission-year dataset. That does not mean 64% of all healthcare cyberattacks globally involve network servers; it describes the location field on these OCR filings.

Reporting Entity Does Not Always Equal Breach Origin

HIPAA allows notification responsibilities to be delegated in some business-associate situations. HHS explains that notification responsibilities can be performed on behalf of affected covered entities when delegation is appropriate.

Consequently, the statement “75% of 2025 filings were classified as healthcare providers” is supportable from the OCR dataset.

The broader statement “75% of healthcare breaches originated inside provider systems” is not necessarily supportable from those filing categories alone.

OCR Ransomware Enforcement

On July 29, 2026, OCR announced a settlement with OSF Healthcare System and identified it as the agency’s 21st ransomware enforcement action. OCR’s announcement emphasized the requirement for an accurate and thorough HIPAA risk analysis.

This enforcement count should not be interpreted as the number of healthcare ransomware attacks. It measures OCR enforcement actions in its ransomware series.

Healthcare Breach Costs Have Declined for Two Consecutive IBM Studies

Because the figures below come from the same IBM report family, they can be compared more safely than unrelated vendor cost estimates.

IBM reported $9.77 million in 2024. Its 2025 study then reported $7.42 million before the current 2026 benchmark fell to $6.64 million.

The decline should not be interpreted as evidence that healthcare breaches are inexpensive. Healthcare still has the highest sector average in IBM’s current study.

IBM groups breach costs into categories including detection and escalation, lost business, post-breach response and notification. In its 2026 analysis, detection/escalation and lost business together accounted for a majority of total costs.

For broader cross-industry context, see ScanTitan’s Data Breach Statistics research.

Initial Counts May Be Estimates

HHS explicitly instructs covered entities to provide an estimate when the number affected is uncertain and to submit updated information later. That means early breach rankings can change materially.

Change Healthcare’s Count Was Revised as the Investigation Progressed

HHS says Change Healthcare notified OCR on October 22, 2024 that about 100 million individual notices had been sent.

On January 24, 2025, it reported approximately 190 million individuals impacted.

On July 31, 2025, the affected population was updated again to approximately 192.7 million.

A research page that retained the earlier number after these later updates would now be stale.

Aflac Has Two Different but Valid Populations

Aflac identified unauthorized access to its U.S. network on June 12, 2025. Its SEC filing said the potentially affected material included claims information, health information, Social Security numbers and other personal information associated with its U.S. business.

By December 2025, Aflac had determined that personal information associated with approximately 22.65 million individuals was involved.

The HIPAA/OCR healthcare filing, however, lists approximately 13.9 million affected individuals.

Those figures should not be forced into one number because they describe different reporting populations.

Different Regulators Can Publish Different Counts

The current OCR-derived register lists 62,224,658 affected individuals for Conduent Business Services, while a later state-regulator submission has reported a slightly different aggregate.

The defensible research approach is not to average the values. For an OCR-based comparison table, the OCR figure should remain the comparable value while the existence of a later regulator figure is disclosed separately.

Change Healthcare: Concentration Risk at National Scale

UnitedHealth disclosed unauthorized access to Change Healthcare systems in February 2024. The incident disrupted healthcare transactions nationally and ultimately produced an HHS estimate of approximately 192.7 million affected individuals.

The important statistical lesson is not only that the breach was large. Change Healthcare demonstrates how dependence on highly connected healthcare intermediaries can make one incident dominate an entire year’s affected-person statistics.

Without understanding that concentration, 2024’s healthcare breach total can look like a uniform sector-wide increase rather than a distribution heavily influenced by one exceptional event.

Conduent: One Event, Different Regulator Totals

The current OCR-derived register lists 62,224,658 affected individuals for Conduent Business Services, making it one of the largest healthcare-related breach filings in the current dataset.

Other regulator reporting has produced a slightly different total. The correct research response is not to average the counts or silently select the larger number. For an OCR-based healthcare table, the OCR figure should remain the comparable value while any later regulator count is explained separately.

Aflac: Scope Matters More Than Headline Size

Aflac’s SEC disclosure eventually identified about 22.65 million people whose personal information was involved in its U.S. incident. Its HIPAA/OCR population is narrower.

This is a useful example of why people affected by the broader cyber incident and individuals included in the HIPAA breach report can be different populations.

It also corrects another common error: Aflac specifically stated that its systems were not affected by ransomware.

Blue Shield of California: A Major Breach Without Ransomware

Blue Shield disclosed that Google Analytics had been configured in a way that allowed certain member information to be shared with Google Ads between April 2021 and January 2024. Blue Shield said it discovered the issue on February 11, 2025 and that no bad actor was involved.

The potentially affected information included insurance-plan information, location data, member account identifiers and certain medical-claim-related details.

This case demonstrates that a large healthcare breach can result from data-flow and tracking configuration, not malware, ransomware or network intrusion.

A Breach Does Not Automatically Mean a HIPAA Penalty

OCR enforcement focuses on compliance with the HIPAA Privacy, Security and Breach Notification Rules, not simply on whether a cyberattack occurred.

For example, in announcing its 21st ransomware enforcement action in July 2026, OCR specifically emphasized the importance and legal requirement of conducting an accurate and thorough risk analysis.

A breach may prompt an investigation, but the existence of a breach by itself should not be presented as proof of a HIPAA violation or an inevitable financial penalty.

Myth 1: “Healthcare Breaches Increase Every Year”

Not necessarily. Different metrics can move in different directions.

The number of OCR filings may rise while the total number of affected individuals falls because one year contains a mega-breach and another does not. The current 2025 register contains more filings than the current 2024 register, yet substantially fewer affected individuals.

Myth 2: “140 Million Affected Individuals Means 140 Million Medical Records”

No. OCR reports the approximate number of individuals affected. That is not a medical-record count.

One person can have many records, and annual aggregates can potentially include the same individual in multiple unrelated incidents.

Myth 3: “Most Healthcare Breaches Happen at Hospitals”

OCR’s largest reporting category is healthcare providers, but “healthcare provider” includes more than hospitals.

More importantly, reporting entity does not necessarily identify the technical origin of every breach. Large business-associate compromises can affect enormous populations across multiple downstream organizations.

Myth 4: “Large Healthcare Breaches Are Basically Ransomware Attacks”

Ransomware is important, but not every large breach involves ransomware.

Aflac said its 2025 systems were not affected by ransomware, while Blue Shield’s disclosure resulted from website analytics and tracking configuration rather than a malicious network intrusion.

Myth 5: “Once OCR Publishes a Number, It Is Final”

HHS permits estimated initial affected-person counts and subsequent updates when new information becomes available.

Change Healthcare is the clearest example: its known affected population was revised as investigation and notification progressed.

Third-Party Concentration Needs Its Own Risk Model

A vendor handling information for dozens or hundreds of healthcare organizations can create much greater systemic exposure than its own organization size suggests.

The 32% third-party figure in Verizon’s healthcare corpus and the scale of Change Healthcare and Conduent make vendor dependencies a core security issue, not merely a procurement concern.

Vulnerability Management Remains Operationally Important

Verizon identified vulnerability exploitation as the leading listed initial-access vector in 20% of its healthcare breaches, ahead of phishing and credential abuse in that dataset.

Healthcare organizations therefore need to understand externally exposed applications, network services and software dependencies rather than focusing exclusively on employee phishing training.

The ScanTitan website vulnerability scanner can support this layer by helping identify certain known and externally observable weaknesses. Automated scanning, however, does not detect every attack path and does not replace penetration testing, identity controls, endpoint security, monitoring or incident response.

Identity and Social Engineering Still Matter

Phishing accounted for 14% and credential abuse 11% of the initial-access vectors identified in Verizon’s healthcare analysis.

That supports layered controls around authentication, phishing resistance, credential protection and access monitoring.

Error Prevention Still Deserves Investment

Healthcare’s persistent Miscellaneous Errors pattern means security programs also need controls against misdelivery, incorrect access, unsafe data flows, exposed storage, tracking misconfiguration and loss of unencrypted devices or media.

Not every meaningful healthcare breach begins with an attacker.

HHS OCR Breach Data

The HHS OCR Breach Portal is the central U.S. regulatory source for HIPAA breaches of unsecured PHI affecting 500 or more individuals.

Because the public register is mutable, annual portal totals in this article are treated as dated snapshots rather than permanent historical facts.

The main annual series and 2026 YTD benchmark use an OCR-derived dataset current through September 4, 2026. It lists 804 filings and 140,574,754 affected individuals for 2025, and 506 filings affecting 74,872,402 individuals in 2026 through September 4.

A separate OCR-derived analytical register reports the same 804 filings for 2025 but a slightly different affected-person sum of 140,514,189. This report preserves the discrepancy rather than averaging the two values.

Occurrence-Year Data

Where occurrence-year reporting is required, HHS’s annual Report to Congress takes precedence.

The latest available report covers 2024 and identifies 663 large breaches occurring during that calendar year, affecting approximately 242.9 million individuals.

No equivalent finalized HHS occurrence-year report for 2025 was available at the time of this research.

Verizon DBIR

Verizon’s 2026 DBIR uses contributed incident data normalized through the VERIS framework. Its healthcare section covers 1,492 incidents and 1,438 confirmed breaches.

These observations are used for attack patterns, actor characteristics and vectors — not for calculating a national HIPAA breach total.

IBM Cost of a Data Breach

IBM’s Cost of a Data Breach research is used for financial benchmarking. The $6.64 million healthcare value is a study average, not a forecast or a universal cost assigned to every healthcare breach.

Research Limitations

• OCR’s public 500+ list does not represent every small HIPAA breach.
• Portal entries can be revised after initial submission.
• Submission date and incident date are different concepts.
• “Individuals affected” is not necessarily a unique-person or record count across an annual aggregate.
• Healthcare security datasets use different populations and definitions.
• OCR, Verizon and IBM should not be merged into one synthetic breach total.