Cybersecurity Study Shows Patient Care at Risk of Attacks
A recent study from cybersecurity company Proofpoint and Ponemon shows that 93 percent of healthcare organizations experienced at least one cyberattack in the past year. This was an average of 43 attacks per organization, up from the average of 40 attacks in 2024.
The report details how these attacks are not only costing health systems millions but also disrupting patient care.
Why It Matters
In a statement, Proofpoint’s Vice President of Industry Solutions Ryan Witt said patient safety is “inseparable from cyber safety.”
“This year’s report highlights a stark reality: cyber threats aren’t just IT issues, they’re clinical risks,” he said. “When care is delayed, disrupted or compromised due to a cyberattack, patient outcomes are impacted, and lives are potentially put at risk.”
Data breaches due to cyberattacks expose patients’ sensitive personal, financial and medical data, putting them at risk for identity theft and fraud.
They also cost health systems millions. The report, which was published earlier this month, found that the average cost of the most significant attack decreased to $3.9 million.
Operational disruptions were the most expensive result of cyberattacks, the report found, followed by lost productivity, cost of the time required to correct patient care impacts, damage or theft of IT assets and infrastructure and remediation and technical support.
Recent class action lawsuits from data breach victims led to major settlements. Integris Health and Eastern Radiology are just two of the latest cases. The Integris Health case, for example, resulted in a $30 million payout to more than two million patients impacted by both the data breach and later extortion from the cybercriminal responsible.
What To Know
The report also specifically highlights how cyberattacks affect patient care at health systems.
It found that 72 percent of healthcare organizations that experienced common cyberattacks in the last 12 months suffered disruptions to patient care. This was up from 69 percent last year. These attacks include ransomware, cloud compromise, supply-chain attacks and business email compromise.
Such disruptions cause various disruptions, including increased complications from medical procedures, longer stays, delays in tests and procedures, and increases both in patient transfers and in mortality rates.
For the first time, the survey asked respondents about their plans to secure clinical operations in the cloud. In total, 75 percent of respondents said they have moved or plan to move clinical operations to the cloud.
“This accelerating shift toward cloud-hosted clinical systems underscores the urgency of addressing cloud/account compromise risks, given the potential impact on patient care and service continuity,” the report said in its executive summary.
What Happens Next
Human error was mostly to blame for these frequent cybersecurity breaches, the report found.
Thirty-five percent of respondents said employees not following policies were the cause of data loss or exfiltration. Other reasons include privileged-access abuse and employees emailing sensitive patient information to wrong recipients.
New technology also remains a top safety concern for health systems, with 55 percent saying they are worried about the risk of insecure mobile apps and 38 percent calling out generative AI or other AI tools as cybersecurity concerns.
As a result of these concerns, the report found that health systems are spending more. The average annual IT budget was $65 million, with 21 percent of that budget dedicated to information security.
They are also taking steps to increase employee awareness of cybersecurity threats with regular training and employee monitoring.
What People Are Saying
Proofpoint’s Ryan Witt said this report “underscores the urgent need for healthcare organizations to adopt a human-centric cybersecurity approach—one that not only protects systems and data but also preserves the continuity and quality of care.”
Dr. Larry Ponemon, the chairman and founder of the Ponemon Institute, said this year’s findings from Proofpoint are “a wake-up call” for the healthcare industry.
“The root cause of many incidents lies in human factors—negligence, insider risk, and gaps in cyber awareness,” he said in a statement. “Cyberattacks are now routinely affecting patient safety, and while security spending is up, many organizations still lack clear leadership and internal expertise to meet the challenge.”
About Author
