The number of large healthcare data breaches slid to a three-year low in the first half of 2026, even as hacking and ransomware dug deeper into the sector, a new midyear tally shows.
Records from the U.S. Department of Health and Human Services count 397 breaches affecting 500 or more people reported between January 1 and June 30. That is a 5.9 percent drop from the same stretch of 2025 and the smallest first-half total since 2023. The incidents exposed the protected health information of 33.77 million people, a 22.6 percent decline year over year.
The softer headline number masks a tougher reality. Losses fell because theft and unauthorized-access incidents eased, while hacking and IT intrusions climbed for a third consecutive year. Extortion crews that copy data and threaten to publish it are now a defining feature of the market.
Nine first-half breaches each hit more than a million people. Imaging provider Lumexa Imaging reported the largest at 5,830,949 individuals. It was followed by claims vendor TriZetto Provider Solutions at 3.43 million, dermatology group QualDerm Partners at 2.95 million, and Nacogdoches Memorial Hospital in Texas at 2.5 million.
Compliance leaders should not read the dip as relief. Thirty-seven breaches still sit at the 500 or 501 placeholder, figures that tend to balloon once reviews wrap up. The 2024 Change Healthcare incident began at 500 and later reached 192.7 million.
