The Uptime report

Uptime Report Research · Healthcare Breaches

Healthcare Data Breach Report 2026: 802 Breaches, 140 Million People, and the Vendor Problem

This healthcare data breach report is built from the HHS Office for Civil Rights breach portal itself: every breach of 500 or more records reported since 2009, exported in full in October 2026. In 2025, providers, health plans, and their vendors reported 802 large breaches, more than in any previous year, affecting 140.5 million people. Hacking caused 81% of them.

802large breaches reported in 2025, a record
140.5Mindividuals affected in 2025
80.8%caused by hacking or IT incidents
35%involved a business associate (vendor)

Breaches and people affected, 2015 to 2025

Large breaches reported Individuals affected (millions)

2701532816357173681851119663207152171822745237412480225290M people

The number of large breaches has risen almost every year, from 270 in 2015 to 802 in 2025. The number of people affected moves with a few very large incidents: 2024 reached 290 million because of the Change Healthcare breach alone. 2025 was lower by people affected but higher by count.

Causes of 2025 breaches

Type of breach Breaches Share Individuals affected
Hacking/IT Incident 648 80.8% 134,332,842
Unauthorized Access/Disclosure 142 17.7% 6,082,639
Theft 9 1.1% 44,417
Loss 2 0.2% 4,008
Improper Disposal 1 0.1% 34,675

Hacking now dominates both the count and the scale. In 2015, hacking caused 21% of large breaches; in 2025, 81%. Theft and loss, the leading causes a decade ago, account for 12 breaches in 2025.

The vendor problem

281 of 802 breaches in 2025 (35%) listed a business associate as present, and those breaches affected 90.1 million people, 64% of everyone affected that year. The largest breach of the year, Conduent Business Services LLC (62.2 million people), was reported by a business associate.

Who reported 2025 breaches

  • Healthcare Provider605
  • Business Associate137
  • Health Plan58
  • Healthcare Clearing House2

Where the data was

  • Network Server509
  • Email195
  • Paper/Films42
  • Electronic Medical Record36
  • Other18
  • Laptop11

The ten largest breaches reported in 2025

# Organization Type State Individuals Cause
1 Conduent Business Services LLC Business Associate NJ 62,224,658 Hacking/IT Incident
2 Aflac Incorporated Health Plan GA 13,924,906 Hacking/IT Incident
3 Episource, LLC Business Associate CA 6,725,572 Hacking/IT Incident
4 Yale New Haven Health System Healthcare Provider CT 5,556,702 Hacking/IT Incident
5 Blue Shield of California Business Associate CA 4,700,000 Unauthorized Access/Disclosure
6 PIH Health, Inc. Healthcare Provider CA 2,947,264 Hacking/IT Incident
7 DaVita Inc. Healthcare Provider CO 2,689,826 Hacking/IT Incident
8 Veradigm LLC Business Associate IL 2,672,036 Hacking/IT Incident
9 Anne Arundel Dermatology Healthcare Provider MD 1,905,000 Hacking/IT Incident
10 Kettering Adventist Healthcare Healthcare Provider OH 1,695,382 Hacking/IT Incident

What this means for healthcare IT and MSPs

Network servers and email are where breached data sat in most 2025 cases, and hacking is the cause behind four in five. For a healthcare provider or the MSP supporting it, that points at server hardening, email security, and monitored, tested backups. The vendor figures matter just as much: an MSP with access to protected health information is itself a business associate, and more than a third of 2025 breaches ran through one.

Frequently asked questions

How many healthcare data breaches were reported in 2025?

802 breaches affecting 500 or more people were reported to the HHS Office for Civil Rights in 2025, the most in any year since reporting began in 2009. The figure comes from the HHS breach portal, including breaches still under investigation and those archived.

How many people were affected by healthcare breaches in 2025?

140,498,581 individuals, the sum of the individuals-affected figures reported for 2025 breaches. That is less than half of 2024, when breaches affected 290,054,222 people, driven by the Change Healthcare breach.

What causes most healthcare data breaches?

Hacking and IT incidents: 648 of 802 breaches in 2025 (80.8%), affecting 134,332,842 people.

What was the largest healthcare data breach in 2025?

Conduent Business Services LLC, a business associate, reported a breach affecting 62,224,658 people in 2025.

How many healthcare breaches involve vendors?

In 2025, 281 breaches (35%) listed a business associate as present, and those breaches affected 90,106,317 people, 64% of the total.

How many healthcare breaches have been reported since 2009?

8,009 breaches affecting 1,094,480,870 individuals were listed on the HHS breach portal as of 09/21/2026. Individuals can appear in more than one breach.

Download the data. hhs-ocr-healthcare-breaches-2009-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

Methodology

Source. U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal, CSV exports of both the Under Investigation and Archive lists, downloaded October 2026. 8,009 unique breaches after removing duplicates across the two lists; latest submission 09/21/2026.

Calculations. Years use the breach submission date. Individuals affected are summed as reported. Business associate share counts breaches where the portal’s business-associate-present field is Yes.

Corrections. An earlier version of this report, published October 4, 2026, used a secondary compilation of the same portal and said that 2025 set a record for people affected and that the largest 2025 breach affected more than 25 million people. The primary data show 2024 had more people affected and the largest 2025 breach affected 62.2 million. This version replaces those figures.

Limitations. The portal lists only breaches of 500 or more records. Organizations can revise counts after submission. Individuals can be counted in several breaches.

Not advice. This is an analysis of public breach records, not legal or compliance advice.

Cite as:The Uptime Report. "Healthcare Data Breach Report 2026: 802 Breaches, 140 Million People, and the Vendor Problem." October 2026. https://theuptimereport.com/healthcare-data-breach-report-2026/

References

  1. HHS Office for Civil Rights, Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information. Accessed October 2026.
  2. HHS, HIPAA Breach Notification Rule. Accessed October 2026.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

Infrastructure and uptime

Regulation and disclosure

Workforce and pay

MSP market and spending

Comments

6 responses to “Healthcare Data Breach Report 2026: 802 Breaches, 140 Million People, and the Vendor Problem”

  1. Ransomware Reported to the FBI: 5-Year Trend

    […] Healthcare Data Breach Report 2026HHS OCR breach portal scorecard […]

    Reply
  2. Federal IT Spending 2026: IT Services Contract Data

    […] Healthcare Data Breach Report 2026HHS OCR breach portal scorecard […]

    Reply
  3. Phishing Statistics 2026: APWG, FBI and HHS Data

    […] has 116 email breaches out of 566 (20.5%), against 158 of 605 (26.1%) by the same date in 2025. Our healthcare data breach report breaks down the rest of the HHS […]

    Reply
  4. Ransomware Groups 2026: The Most Active Gangs, Ranked

    […] Healthcare Data Breach Report 2026HHS OCR breach portal scorecard […]

    Reply
  5. Data Centers by State 2026: Sites, Jobs, and Power

    […] Healthcare Data Breach Report 2026HHS OCR breach portal scorecard […]

    Reply
  6. Cybersecurity Statistics 2026: 70 Primary-Sourced Facts

    […] Breaches of 500 or more health records reported to HHS in 2025, the most in any year since reporting began in 2009. Hacking caused 80.8% of them, in our analysis of the HHS breach portal. […]

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts