Almost every healthcare organization surveyed got hit this year, and most felt it in the exam room. The 2026 Ponemon Healthcare Cybersecurity Report, sponsored by Proofpoint, found 97% of organizations suffered at least one cyberattack in the past 12 months, averaging 51 attacks each, up from 43 a year earlier. In 74% of incidents, patient care took a direct hit.
Supply chain attacks caused the worst clinical damage. Ninety percent of organizations hit through a vendor reported an impact on care, followed by ransomware at 72%, business email compromise at 69%, and cloud or account compromise at 65%. The consequences read like a clinical harm register: 70% said ransomware lengthened patient stays, 68% tied BEC to delayed procedures and tests, 59% linked cloud compromises to more procedure complications, and 35% said supply chain attacks raised mortality rates. The most expensive single incident averaged $4.2M, up from $3.9M, with operational disruption alone costing $1.39M.
The report also flags a governance gap opening around AI. Forty-five percent of respondents have embedded AI, split between security operations and patient care, but 60% said controls over sensitive data in AI systems are insufficient and only 32% have full visibility into AI tool use. Top concerns were AI vendor supply chain risk (40%), prompt-based data leakage (36%), and AI-generated phishing (34%).
For healthcare leaders, the takeaway is a two-front agenda: vendor risk management that actually covers clinical continuity, and AI governance that keeps pace with adoption. Insider risk remains unresolved too, with 97% reporting at least two data-loss incidents and 56% linking those to higher mortality.
