Healthcare organizations reported 66 large data breaches to the HHS Office for Civil Rights in June 2026, a slight increase from the 64 logged in May and a pace of more than two per day. Together the incidents exposed protected health information belonging to at least 4,499,972 people, a figure expected to climb as probes wrap up.
By the numbers, the typical June breach hit 68,181 people, and the median incident touched 6,306. Victim totals slid 36.3% from May and landed 58.7% under the trailing-year average, which itself was lifted by an outsized October 2025 tally. Year to date, roughly 34 million individuals have had protected health information exposed, down 37.7% from the 54.4 million logged through the first half of 2024 and 22.1% below the same period in 2025. The number of reported incidents is down 3.2% from 2024 and 6.4% from 2025, though volumes remain far above 2022 and 2023 levels.
June logged 25 breaches of 10,000-plus people each, and the two biggest both hit business associates. Xsolis, a technology company providing AI-powered case and utilization management tools, reported almost 1.4 million affected individuals after a January phishing email gave an attacker four days of network access. MCBS, a medical billing and revenue cycle management firm, reported more than 1.25 million affected after the PEAR extortion group breached its network in September 2025. The Worldleaks group was tied to two additional large disclosures: Centers Lab NJ, a diagnostic laboratory, reported 542,377 affected individuals, and Operation PAR, a Florida behavioral health provider, reported 145,714.
For healthcare CISOs, the report is a reminder that business associates and vendors remain the highest-impact attack surface, with phishing and extortion-driven network access driving the largest patient counts.
