Ponemon/Proofpoint survey: 97% of US healthcare orgs hit by cyberattacks, operational disruption now costliest impact at $1.39M
A Ponemon Institute and Proofpoint survey of 705 IT and security practitioners at U.S. healthcare institutions (conducted May 2026) found that 97% of organizations suffered at least one cyberattack in the past 12 months, and 74% of those reported disruption to patient care. The average number of attacks per organization rose to 51 from 43 in 2025. Operational disruption is now the single largest cost component, averaging $1.39 million (up from $1.2 million), and the average cost of the most expensive attack rose nearly 8% to $4.2 million. Fewer organizations are paying extortion demands, yet ransomware continues to disrupt patient care. The report also flags a governance gap as healthcare adopts AI faster than it can secure it.
Detalhes técnicos
- 45% of organizations have embedded AI in cybersecurity, or in both cybersecurity and patient care, and another 30% plan to adopt it.
- 60% lack controls governing sensitive data used in AI systems, and only 42% use security measures designed for AI.
- The top AI risk, cited by nearly 40% of respondents, is supply chain risk from AI vendors. Others include data leakage via prompts, AI-generated phishing and social engineering, inadequate privacy protections, and non-compliant tool usage.
- Human-driven risks remain relevant: phishing, compromised accounts, employee mistakes and data loss.
Remediação
- Shift from cyber defense to cyber resilience, so clinical services can be maintained and restored during an attack.
- Implement microsegmentation to keep a simple breach from becoming a large-scale incident (per ColorTokens' Guru Gurushankar).
- Inventory where AI is used, what sensitive data it can access and what actions AI agents are permitted to take, and put governance and AI-specific security controls around them.
- Prioritize third-party and AI vendor risk management and continue to address phishing and account compromise.
Linha do tempo
-
Ponemon/Proofpoint survey: 97% of US healthcare orgs hit by cyberattacks, operational disruption now costliest impact at $1.39M
ler a análise desta fonte ocultar
A Ponemon Institute and Proofpoint survey of 705 IT and security practitioners at U.S. healthcare institutions (conducted May 2026) found that 97% of organizations suffered at least one cyberattack in the past 12 months, and 74% of those reported disruption to patient care. The average number of attacks per organization rose to 51 from 43 in 2025. Operational disruption is now the single largest cost component, averaging $1.39 million (up from $1.2 million), and the average cost of the most expensive attack rose nearly 8% to $4.2 million. Fewer organizations are paying extortion demands, yet ransomware continues to disrupt patient care. The report also flags a governance gap as healthcare adopts AI faster than it can secure it.
Technical Details
- 45% of organizations have embedded AI in cybersecurity, or in both cybersecurity and patient care, and another 30% plan to adopt it.
- 60% lack controls governing sensitive data used in AI systems, and only 42% use security measures designed for AI.
- The top AI risk, cited by nearly 40% of respondents, is supply chain risk from AI vendors. Others include data leakage via prompts, AI-generated phishing and social engineering, inadequate privacy protections, and non-compliant tool usage.
- Human-driven risks remain relevant: phishing, compromised accounts, employee mistakes and data loss.
Remediation
- Shift from cyber defense to cyber resilience, so clinical services can be maintained and restored during an attack.
- Implement microsegmentation to keep a simple breach from becoming a large-scale incident (per ColorTokens' Guru Gurushankar).
- Inventory where AI is used, what sensitive data it can access and what actions AI agents are permitted to take, and put governance and AI-specific security controls around them.
- Prioritize third-party and AI vendor risk management and continue to address phishing and account compromise.