Study of 65 hospital cyberattacks shows impact on patient care

What happened

The Health Management Academy, a member-based organization for senior healthcare executives, published an analysis of cyberattacks on U.S. hospitals and health systems that affected patient care. HIPAA Journal reported on it on 2026-11-11, and DataBreaches.net carried a story with the same headline on 2026-11-12 DataBreaches.net. Only the headline of the DataBreaches.net piece was available to us, so the details below come from HIPAA Journal.

Per HIPAA Journal, the researchers logged incidents between January 2022 and September 2026 where a patient care impact was reported, using news coverage, trade publications and hospital statements. Findings reported:

• At least 65 cyberattacks affected hospital care, including ambulance diversions, cancelled elective surgeries and appointments, and staff switching to paper records.
• The 65 attacks affected at least 305 hospitals in 36 U.S. states, the District of Columbia, Guam and the US Virgin Islands. 21 attacks hit more than one hospital, and one incident affected 140 hospitals.
• Ambulances were put on divert in 26 attacks (40%). Patients faced delays from cancelled or postponed surgeries, appointments or treatments in 28 attacks (43%).
• Key systems went offline in 58 attacks (89%), forcing paper records.
• For the 23 attacks with a restoration date for clinical systems such as electronic medical records, median downtime was 15 days. 51% of attacks saw longer downtime, and 22% involved more than a month.

HIPAA Journal says the true figure is likely substantially higher. It cites Comparitech, which tracked 293 ransomware attacks on hospitals, clinics and other direct care providers in the first 9 months of 2025 alone.

The study also points to a reporting gap. The HIPAA Breach Notification Rule requires reporting of data breaches, not cyberattacks, to the HHS Office for Civil Rights (OCR). OCR publishes only breaches affecting 500 or more individuals. HIPAA Journal reports that 807 large healthcare data breaches were reported to OCR for 2025, 81% of them listed as hacking/IT incidents. The Academy identified only 12 attacks in 2025 with a confirmed patient care impact, and one in five attacks publicly disclosed more than a year ago is still not on the OCR portal.

HIPAA Journal also cites research suggesting higher mortality after ransomware attacks, including an increase of between 34% and 38% for patients admitted in the week before an attack. It describes this as a growing body of research, not a finding of this study.

Am I affected?

This is a study of reported incidents, not a vulnerability or a single campaign. No CVE, product, attacker or attack method is named in the sources, and these are not confirmed. It is relevant if you operate or support U.S. hospitals or health systems, or work in healthcare compliance.

If you rely on the OCR breach portal to gauge how often cyberattacks disrupt care, the sources indicate it undercounts such incidents, because attacks without a confirmed data breach, or affecting fewer than 500 people, are not listed.

What to do now

1. Record the clinical impact of any incident, not only data exposure. The Academy suggests days of clinical downtime, hours on diversion and the number of procedures postponed.
2. Use those metrics to benchmark your readiness and recovery against peers. The Academy says its programs offer a way to share this data.
3. Do not treat the absence of an OCR breach listing as evidence that no care disruption occurred. The study found that such disruptions are often missing from the federal record.
4. Do not wait for a mandate. HIPAA Journal says there are no indications that OCR will require such reporting metrics in the foreseeable future.

Sources

• HIPAA Journal: Study Provides Insights into Impact of Cyberattacks on Hospital Care
• DataBreaches.net: Study Provides Insights into Impact of Cyberattacks on Hospital Care