HIPAA Journal Compiles Healthcare Breach Statistics: 772 Large Breaches in 2025, Hacking Over 80%, OCR Backlog Growing
The HIPAA Journal has updated its compilation of HHS OCR breach portal data (October 2009 to August 2026, data pulled October 10, 2026). It shows a record 772 large healthcare breaches (500+ individuals) in 2025, after a sharp rise between 2018 and 2021 driven by ransomware. From January to April 2026, 252 large breaches were reported, 9.5% fewer than the same period in 2025, but OCR publication delays after the 43-day government shutdown in late 2025 make this incomplete. Mega breaches drive victim counts: Change Healthcare (192.7 million, the largest ever), Conduent Business Services (62.2 million), Aflac (13.9 million) and Episource (6.7 million). Hacking and other IT incidents accounted for more than 80% of large breaches in 2025.
Detalhes técnicos
- 7,670 large breaches were reported to OCR between October 21, 2009 and April 30, 2026. Between 2009 and 2025, 7,418 breaches exposed 1,013,066,481 records.
- Large breaches ran at about 2.1 per day in 2025. About 138.5 million individuals were affected in 2025, versus roughly 289 million in 2024.
- OCR reported a 239% rise in hacking-related breaches and a 278% rise in ransomware attacks between 2018 and September 2023. Hacking accounted for 79.7% of breaches in 2023, up from 49% in 2019.
- Loss/theft and improper disposal incidents are now rare. Unauthorized access/disclosure incidents rose in 2025, partly due to tracking and analytics technologies on healthcare sites without business associate agreements.
- Business associate breaches are under-represented in reporting-entity statistics because covered entities often report separately. Examples cited are Eye Care Leaders (2022) and AMCA (2019). Supply chain security is called a top 2026 challenge.
- 936 OCR investigations are open or awaiting start, up from 882, on a flat budget. OCR focuses hacking investigations on HIPAA Security Rule risk analysis failures, with 11 such penalties closed as of January 31, 2026.
Remediação
The article recommends vendor due diligence and ongoing monitoring of business associates' Security Rule compliance, encryption of ePHI, HIPAA and security awareness training, and monitoring of access to medical records.
Linha do tempo
-
HIPAA Journal Compiles Healthcare Breach Statistics: 772 Large Breaches in 2025, Hacking Over 80%, OCR Backlog Growing
ler a análise desta fonte ocultar
The HIPAA Journal has updated its compilation of HHS OCR breach portal data (October 2009 to August 2026, data pulled October 10, 2026). It shows a record 772 large healthcare breaches (500+ individuals) in 2025, after a sharp rise between 2018 and 2021 driven by ransomware. From January to April 2026, 252 large breaches were reported, 9.5% fewer than the same period in 2025, but OCR publication delays after the 43-day government shutdown in late 2025 make this incomplete. Mega breaches drive victim counts: Change Healthcare (192.7 million, the largest ever), Conduent Business Services (62.2 million), Aflac (13.9 million) and Episource (6.7 million). Hacking and other IT incidents accounted for more than 80% of large breaches in 2025.
Technical Details
- 7,670 large breaches were reported to OCR between October 21, 2009 and April 30, 2026. Between 2009 and 2025, 7,418 breaches exposed 1,013,066,481 records.
- Large breaches ran at about 2.1 per day in 2025. About 138.5 million individuals were affected in 2025, versus roughly 289 million in 2024.
- OCR reported a 239% rise in hacking-related breaches and a 278% rise in ransomware attacks between 2018 and September 2023. Hacking accounted for 79.7% of breaches in 2023, up from 49% in 2019.
- Loss/theft and improper disposal incidents are now rare. Unauthorized access/disclosure incidents rose in 2025, partly due to tracking and analytics technologies on healthcare sites without business associate agreements.
- Business associate breaches are under-represented in reporting-entity statistics because covered entities often report separately. Examples cited are Eye Care Leaders (2022) and AMCA (2019). Supply chain security is called a top 2026 challenge.
- 936 OCR investigations are open or awaiting start, up from 882, on a flat budget. OCR focuses hacking investigations on HIPAA Security Rule risk analysis failures, with 11 such penalties closed as of January 31, 2026.
Remediation
The article recommends vendor due diligence and ongoing monitoring of business associates' Security Rule compliance, encryption of ePHI, HIPAA and security awareness training, and monitoring of access to medical records.