Cyberattacks continue to threaten patient safety and hospital operations, with 97 percent of U.S. healthcare organizations surveyed reporting at least one attack in the past year, according to a new report from Proofpoint and the Ponemon Institute.

The 2026 Study on Cyber Insecurity in Healthcare found that affected organizations experienced an average of 51 attacks, up from 43 in 2025. The average cost of the most expensive attack reached $4.2 million.

Patient care was also significantly affected. Overall, 74 percent of organizations experiencing four major types of cyberattacks reported care disruptions. Supply chain attacks were particularly concerning, with 90 percent of affected organizations reporting disruptions. Meanwhile, 72 percent of organizations experiencing ransomware attacks reported impacts on patient care.

The report also highlighted growing risks associated with artificial intelligence (AI). Although 45 percent of respondents said their organizations had adopted AI in cybersecurity or patient care, only 40 percent had controls governing sensitive data used in AI systems.

Data loss remains another major challenge. Organizations reported an average of 21 data loss or exfiltration incidents involving sensitive information over two years. More than half of respondents said these incidents disrupted patient care.

“Cyber resilience has become essential to healthcare resilience,” said Ryan Kalember, chief strategy officer, Proofpoint, in a statement. “When a cyberattack delays a procedure, extends a hospital stay, or forces patients to another facility, cyber risk becomes patient risk. AI is now adding another dimension as people and AI systems access the same sensitive data and clinical workflows. Healthcare organizations need security built around those interactions so they can adopt AI without compromising the trust patient care depends on.”

The study was sponsored by Proofpoint and conducted by the Ponemon Institute, based on responses from 705 healthcare IT and IT security practitioners in the United States.