Proofpoint and Ponemon Institute released findings from their fifth annual Cyber Insecurity in Healthcare report, revealing that cyberattacks are becoming more frequent, costly, and operationally impactful across U.S. healthcare organizations.
97% of organizations surveyed experienced at least one cyberattack in the past 12 months, of which 74% reported disruption to patient care as a result. The average number of attacks climbed to 51, from 43 in 2025, and the average cost of the most expensive cyberattack rose nearly 8% to $4.2 million. AI adoption is also outpacing governance, with AI agents operating without guardrails emerging as a leading cause of data loss, cited by 24% of respondents.
“Cyber resilience has become essential to healthcare resilience,” said Ryan Kalember, chief strategy officer, Proofpoint. “When a cyberattack delays a procedure, extends a hospital stay, or forces patients to another facility, cyber risk becomes patient risk. AI is now adding another dimension as people and AI systems access the same sensitive data and clinical workflows. Healthcare organizations need security built around those interactions so they can adopt AI without compromising the trust patient care depends on.”