Admin costs ‘the tip of the iceberg’ for healthcare organizations hit by cyber attacks

The survey we quoted in 2023 has been run four more times. The numbers have not improved.

When we first wrote this in March 2023, the figure that stopped us was 23%. That was the share of healthcare organizations in a Ponemon Institute survey who said a cyberattack had raised their patient mortality rate. The administrative costs of an attack, the forensics, the notifications and the overtime, were the visible part. The deaths were the rest of the iceberg.

The survey has been repeated every year since, and a separate team has now measured the deaths directly. Here is where the water line sits in October 2026.

What the surveys say now

The Proofpoint-Ponemon study published on October 13, 2026 surveyed 705 IT and security practitioners at US healthcare organizations:

• 97% had at least one cyberattack in the past 12 months, an average of 51 per organization. In the 2022 survey it was 89% and 43.
• 74% said an attack disrupted patient care.
• Among those, 53% saw more complications from procedures, 52% longer stays and 52% delayed tests or procedures.
• In the 2025 edition, 29% of organizations hit said mortality rose as a result. In 2022 it was 23%.
• Supply chain attacks disrupted care at 90% of the organizations that had one. Ransomware did at 72%, and 70% of those reported longer patient stays.
• The most expensive single attack cost an average of $4.2 million: $1.39 million of it disruption to normal operations, $1.05 million idle staff and lost productivity.
• 31% of ransomware victims paid. The average largest payment was $1.1 million.
• Employee negligence was again the leading reported cause of data loss. The 2022 study said the same and recommended training and monitoring. Four years on, most organizations are still being let in through the front door.

The deaths are measured now, not estimated

A survey records what people believe happened. A team at the University of Minnesota School of Public Health looked at what did happen. Using Medicare claims from hospitals hit by ransomware between 2016 and 2021, and comparing them with hospitals that would be attacked later, they found that patients who were already admitted when an attack began were roughly a third more likely to die in hospital than they would otherwise have been. Monitors go dark, records go to paper, labs and imaging slow down, and the sickest patients are the ones who cannot wait. The work was presented in 2023 and has since been peer-reviewed.

A hospital on paper records and diverted ambulances is a hospital treating patients later, further away and with less information.

What the big attacks cost

• Universal Health Services, September 2020. Ryuk ransomware took the chain's US systems offline. Ambulances were diverted and procedures moved to other facilities. UHS put the pre-tax cost at $67 million.
• Tenet Healthcare, April 2022. A month-long outage across part of its acute-care operations. Tenet told the SEC the impact was about $100 million. Our 2023 article dated this to 2020. It was 2022.
• Change Healthcare, February 2024. Attackers used stolen credentials on a server with no multi-factor authentication, took data on 190 million people, the largest healthcare breach on record, and shut down claims processing for hospitals and practices across the country for weeks. UnitedHealth has put its cost at $3.1 billion.

Why this ends up as a malpractice claim

A delayed test is a delayed diagnosis. A longer stay is more exposure to infection and error. A diverted ambulance is a patient treated later and further away. None of those is a cyber claim. They are the facts of a malpractice suit, and the plaintiff does not have to prove who the attacker was, only that the hospital's systems failed and the patient was harmed as a result. Expect the complaint to add that the hospital knew the risk, because every survey above was public.

Patients also sue over the breach itself. Change Healthcare's 190 million notices became class actions within weeks. That claim is a privacy claim, and it lands on a different policy.

What to do about it

The controls are not exotic, and they are also the questions on every cyber application:

• Multi-factor authentication on every remote login, including vendor portals. Change Healthcare's was the one server without it.
• Backups that are offline and have been restored from, not just written.
• Downtime procedures that have been practiced. Paper charting, manual medication checks and diversion rules that staff have run through, not just a binder on a shelf.
• A list of every account that can reach patient data, and leavers removed the day they leave.
• One question to every vendor that touches your data: what happens to us if you are breached, and who pays.

Then read two policies side by side. Cyber liability covers the breach: forensics, notification, regulatory defense, the ransom negotiation and the income lost while systems are down. Malpractice covers the patient harmed while they were down. Many cyber policies exclude bodily injury, and some malpractice policies say nothing about care delivered during an outage. A hospital or practice needs both, and needs to know which one answers before the morning it matters.

Associated Resources

• Cyber liability insurance for healthcare providers
• Insurance for hospitals
• The Baltimore bridge collapse: a cyber security wake-up call?
• Our knowledge base on cyber attacks and why they happen

Sources

1. Proofpoint and Ponemon Institute, October 13, 2026: Healthcare sees no relief from cyberattacks disrupting patient care
2. Ponemon Sullivan Report, November 2025: the 2025 study on cyber insecurity in healthcare
3. NPR, October 2023: ransomware attacks against hospitals put patients' lives at risk, researchers say
4. UHS discloses the cost of its September 2020 cyberattack: $67 million
5. Tenet Healthcare, Q2 2022 earnings release: the cybersecurity incident
6. Fierce Healthcare, January 2025: UnitedHealth estimates 190 million people affected