Healthcare Cyberattacks Increasing and Having Greater Impact on Patient Care

Posted by Steve Alder

Cyberattacks on healthcare organizations are continuing to rise, are becoming costlier to resolve, and are increasingly negatively impacting patient care, according to a recent survey conducted on behalf of the cybersecurity firm Proofpoint. The findings were published in the 2026 Ponemon Healthcare Cybersecurity Report.

The survey was conducted by the Ponemon Institute and included 705 responses from IT and IT security practitioners whose responsibilities include setting cybersecurity policies, selecting vendors and contractors, and managing security budgets. The respondents included public healthcare providers (22%), private healthcare providers (18%), healthcare insurers (18%), payers (11%), healthcare insurance companies (10%), with the remainder from life sciences, pharma, and biotechnology companies.

According to the survey, 97% of organizations experienced at least one cyberattack in the past 12 months, with an average of 51 attacks per organization, up from 43 attacks this time last year. In 74% of incidents, the incidents had a negative impact on patient care. The report was focused on four categories of cyberattack: cloud/account compromises, business email compromise, ransomware attacks, and supply chain attacks. Supply chain attacks had the greatest impact on patient care, with 90% of respondents affected by a supply chain attack reporting that it impacted patient care, followed by ransomware attacks (72%), business email compromise incidents (69%), and cloud/account compromises (65%).

Sixty-eight percent of respondents said business email compromise attacks resulted in delays to procedures and tests, 70% of respondents said ransomware attacks resulted in longer patient stays, 59% of respondents said cloud/account compromises resulted in an increase in complications from medical procedures, and 35% of respondents said supply chain attacks resulted in an increased mortality rate.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

These attacks are costly for healthcare organizations. Respondents were asked about the cost of the most expensive cyberattack at their organization in the past 12 months. The average cost of the most expensive attack was $4.2 million, up from $3.9 million in 2025. The most expensive element was disruption to business operations, which cost an average of $1.39 million per incident, up from $1.2 million in 2025.

The survey revealed that healthcare organizations are embracing AI tools, with 45% of respondents confirming that they have embedded AI, 24% in cybersecurity operations and 21% in cybersecurity and patient care; however, utilization often exceeds the ability to govern and secure those tools and platforms. Sixty percent of respondents said that they lacked sufficient controls governing the sensitive data used in AI systems, and while security measures had been implemented, 42% said those measures had not been developed for use with AI platforms. Only one-third (32%) of respondents said they have full visibility into the usage of AI tools within their organization. The biggest perceived AI-specific risks were supply chain risk from AI vendors (40%), data leakage through prompts (36%), AI-generated phishing/social engineering attempts (34%), and malicious or biased outputs that affect care decisions (32%).

While hacking incidents continue to increase, insider risk continues to be a problem in healthcare, with 97% of organizations experiencing at least two data loss or exfiltration incidents in the past 12 months, with an average of 21 incidents at each organization. More than half of respondents (54%) said these incidents impacted patient care, and 56% of respondents said these insider incidents resulted in an increase in mortality rates.

“Cybersecurity incidents are increasingly disrupting clinical operations, consuming organizational resources, and affecting care delivery,” explained Proofpoint.  “The healthcare organizations that will be most successful in the years ahead will be those that combine cyber resilience, identity security, human risk management, supply chain security, and AI governance into a unified strategy focused on protecting both operations and patient outcomes.”

The post Healthcare Cyberattacks Increasing and Having Greater Impact on Patient Care appeared first on The HIPAA Journal.

Mid Florida Dermatology & Plastic Surgery Data Breach Affects 85K Patients

Posted by Steve Alder

Data breaches have been announced by Mid Florida Dermatology & Plastic Surgery, Kannarr Eye Care in Kansas, and Indiana University Health Affiliated Covered Entity.

Mid Florida Dermatology & Plastic Surgery

Mid Florida Dermatology & Plastic Surgery, a medical group with 33 locations in central Florida, has notified the HHS’ Office for Civil Rights about a data breach affecting 85,585 individuals. According to a September 10, 2026, notice on the medical group’s website, unusual activity was identified within its computer systems on March 30, 2026. The forensic investigation determined that an unauthorized third party had access to its network from March 26, 2026, to March 30, 2026, during which time files containing patient data may have been viewed or acquired.

The data review determined that the information potentially accessed or obtained included names, addresses, dates of birth, passport numbers, Social Security numbers, driver’s license numbers, Medicare numbers, other government identification numbers, financial account numbers, financial account access information, health insurance information, and medical information. The types of information involved varied from individual to individual. Mid Florida Dermatology & Plastic Surgery said it is reviewing its security policies and procedures and is taking steps to reduce the risk of similar incidents in the future.

Kannarr Eye Care

Kannarr Eye Care, an optometry practice based in Pittsburg, Kansas, has identified unauthorized access to its computer systems. The incident was identified on March 30, 2026, and the forensic investigation determined that an unauthorized third party accessed or acquired files containing patients’ personal and protected health information.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

A review of the affected data was completed on August 17, 2026, confirming that names, Social Security numbers, and health insurance information were involved. Kannarr Eye Care has enhanced its security measures, implemented additional technical safeguards, and strengthened its policies and procedures related to data privacy and security to reduce the risk of similar incidents in the future. Notification letters were mailed to the affected individuals on September 17, 2026. The data breach was reported to the HHS’ Office for Civil Rights as affecting 14,003 individuals.

Indiana University Health, Affiliated Covered Entity

Indiana University Health Affiliated Covered Entity, has disclosed a security incident that has affected 2,080 individuals. The incident involved one of its vendors, AME Group. AME Group provides information technology services for an isolated IU Health legacy system. IU Health learned on August 4, 2026, that a previously unknown security vulnerability was susceptible to exploitation. Steps were immediately taken to verify the security of its systems, and while it was established that its core systems and electronic medical records were unaffected, a review of AME’s external vendor-managed system confirmed that there had been unauthorized access to limited imaging center information related to patients in Southern Indiana.

The information involved varied from individual to individual and may have included names, birth dates, health plan ID numbers, and limited treatment information related to the imaging center. The affected individuals were notified on September 29, 2026.

The post Mid Florida Dermatology & Plastic Surgery Data Breach Affects 85K Patients appeared first on The HIPAA Journal.

$6.4 Million Settlement Agreed in AMCA Customer Data Breach Litigation

Posted by Steve Alder

A settlement has been agreed to partly resolve litigation stemming from a cyberattack on American Collection Medical Agency (AMCA).  The settlement resolves the “Other Labs Track” of the litigation and has been agreed to by the plaintiffs and AMCA clients Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc., and Austin Pathology Associates. The defendants have agreed to pay $6,438,578.20 to resolve all claims against them related to the AMCA data breach.

AMCA, a subsidiary of Retrieval-Masters Creditors Bureau, Inc., specializes in recovering small-balance medical debt for clinical laboratories and healthcare providers. The company identified a cyberattack on March 30, 2029, and the forensic investigation determined that an unauthorized third party had access to sensitive data between August 1, 2018, and March 30, 2019, following an attack on AMCA’s web payment portal. Data compromised in the incident included names, contact information, government-issued identifiers, medical billing information, financial account and payment information. More than 27 million individuals are believed to have been affected in total.

Many lawsuits were filed against AMCA and its clients in response to the data breach, asserting claims for negligence, breach of contract, and other claims. The lawsuits were consolidated in the U.S. District Court for the District of New Jersey, and after six years of hard-fought litigation, the defendants on this track – In Re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation (All Actions Against Other Labs Track) – have agreed to a settlement to avoid further litigation costs and the uncertainty of a trial and any associated appeals. The defendants continue to deny wrongdoing and liability and maintain that the plaintiffs and class members have not suffered any injury or damage as a result of the cyberattack or data breach.

The defendants have agreed to establish a $6,438,578.20 settlement fund to cover all costs and expenses related to the litigation, including attorneys’ fees and expenses, settlement administration and notice costs, service awards for the class representatives, and claims from the class members. Class members are entitled to claim two years of medical and health information monitoring through the CyEx Medical Shield Pro service. In addition, a claim may be submitted for compensation for documented, unreimbursed out-of-pocket losses due to the data breach up to a maximum of $5,000 per class member, which may include up to 10 hours of documented lost time at $25 per hour.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Class members who choose not to submit a claim for compensation of losses and/or lost time may choose to receive a one-time cash payment, the value of which will depend on the claims received, but has been estimated to be approximately $50. The important dates for class members are a deadline of December 3, 2026, for objecting to and opting out of the settlement, and January 4, 2027, for submitting a claim. The final fairness hearing has been scheduled for January 7, 2026.

The post $6.4 Million Settlement Agreed in AMCA Customer Data Breach Litigation appeared first on The HIPAA Journal.