Cyber Insurance News report on healthcare cyberattacks showing a dark hospital corridor with blank monitors and an empty gurney

Healthcare Ransom Payments Keep Falling. Downtime Still Drives The Bill.

by

Estimated reading time: 6 minutes

Fewer healthcare organizations hit by ransomware are paying, a Ponemon Institute survey for Proofpoint finds. The costliest healthcare cyberattacks still averaged $4.2 million, mostly in downtime. The patient harm the study highlights may sit outside cyber cover.

Healthcare organizations hit by ransomware are paying less often. In 2022, 51% said they paid. This year, 31% did. The share has dropped every year in between.

The figures come from Ponemon Institute’s 2026 Study on Cyber Insecurity in Healthcare, sponsored by email security company Proofpoint. Ponemon surveyed 705 IT and IT security practitioners at healthcare organizations in May 2026. This is the fifth annual edition.

The costliest ransom paid also fell, to an average of $1.09 million from $1.24 million in 2025. GuidePoint Security’s negotiators saw the same direction in their third-quarter cases, on a far smaller sample.

For insurers, the ransom is a shrinking part of the problem. The higher cost is the time systems stay down.

Healthcare Cyberattacks Cost More Than In 2025

Ninety-seven percent of respondents said their organization had at least one cyberattack in the past 12 months. Those organizations averaged 51 attacks, up from 43 in 2025.

Respondents put the average total cost of their single most expensive attack at $4.2 million. That is up from $3.9 million in 2025. It is still below the $4.99 million reported in 2023 and $4.74 million in 2024.

Chart showing the share of healthcare ransomware victims that paid falling from 51 percent in 2022 to 31 percent in 2026, and downtime as the largest cost of the costliest attack
The share of healthcare ransomware victims that paid has fallen every year since 2022. Downtime made up more than half the cost of the costliest attack. Source: Ponemon Institute, sponsored by Proofpoint.

Downtime Drives Healthcare Cyberattack Costs

Disruption to normal operations was the largest cost, at $1.39 million. Idle time and lost productivity added $1.05 million. Together they made up more than half the total, and both rose from 2025. Damage to IT assets and remediation costs fell.

See also  Shocking NFL Draft Prank Exposes Cybersecurity Flaws in Remote Work

Chao Cheng-Shorland, CEO of Shelterzoom, described the same pattern on the Cyber Insurance News podcast. She told of hospitals that refused to pay and restored from backups over about three weeks. The insurer paid out anyway. “We’re really talking about continuity during failure, not recovery after failure,” she said.

Supply Chain And Email Attacks On Healthcare Rise

Half of respondents said their organization suffered a supply chain attack, up from 44% in 2025. Of those, 90% said it disrupted patient care.

The 2024 attack on Change Healthcare, a UnitedHealth Group claims processor, showed how far one supplier’s breach can reach. It affected about 192.7 million people, Cyberinsider reported. That figure comes from a July 2025 filing with the HHS Office for Civil Rights.

See Our Podcast

“I’m going to come after your third-party suppliers.” On the Cyber Insurance News podcast, CDL Cyber Intelligence CEO Jonathan Palmer explains how attackers pick a way in.

Cyber Insurance News & Information (CINI) podcast on dark web monitoring with CDL Cyber Intelligence, Think Like A Criminal, Act Like An Angel, over a rain-soaked alley with a green-lit doorway

Business email compromise (BEC) rose too. Sixty-five percent of respondents reported BEC attacks, up from 62%. The share naming BEC a top concern climbed to 48% from 40%.

Insurers see it in claims. Travelers reported BEC claims running 57% higher in the first half of 2026 than a year earlier. Matthew Butler, its director of cyber risk services, walked through the findings on the Cyber Insurance News podcast.

AI Adds To Healthcare Cyberattack Risk

Forty-five percent of respondents said their organizations have embedded AI in cybersecurity, or in both cybersecurity and patient care. Sixty percent lack controls governing sensitive data used in AI systems. Twenty-four percent named AI agents without guardrails as a leading cause of data loss.

See also  Ransomware Gangs Drop Encryption And Lean Into Data Theft Extortion

Whether a policy responds to an AI-driven loss is often left unsaid. RAND found that the largest group of insurer filings it reviewed neither affirms nor excludes AI.

Patient Care Disruption And The Cyber Policy Gap

Across the four attack types studied, an average of 74% of affected organizations said attacks disrupted patient care. Among those whose care suffered from a supply chain attack, 35% said mortality rates rose.

These are respondents’ assessments. The survey does not measure patient outcomes. Its respondents also reach well beyond hospitals. Only 40% work at healthcare providers. Another 39% work at health insurers or payers, and 21% at life sciences, biotech or pharma companies.

Patient care disruption may also land on a different policy. Bodily injury cover under a cyber policy is “customarily limited to mental anguish and emotional distress,” broker WTW wrote in a client alert. Some cyber policies offer contingent bodily injury cover, WTW noted, often limited to harm that stems directly from the incident.

Healthcare professional liability may respond to patient injury claims, WTW said. But data-related exclusions in those policies are “becoming increasingly common,” it warned.

For healthcare organizations, the cyber policy and the malpractice policy now need to be read together.

FAQ – Healthcare Cyberattacks

Are healthcare organizations still paying ransoms?

Fewer are. In Ponemon Institute’s 2026 survey, 31 percent of healthcare organizations hit by ransomware said they paid, down from 51 percent in 2022.

How much do healthcare cyberattacks cost?

Respondents put their single most expensive attack at 4.2 million dollars on average, up from 3.9 million in 2025 but below 2023 and 2024 levels.

See also  Vulnerability Exploitation Overtakes Stolen Credentials As The #1 Breach Vector

What is the biggest cost of a healthcare cyberattack?

Downtime. Disruption to operations averaged 1.39 million dollars and idle time 1.05 million, together more than half the total.

How common are supply chain attacks on healthcare?

Half of respondents reported one, up from 44 percent in 2025. Of those, 90 percent said it disrupted patient care.

Does cyber insurance cover patient harm?

Often not fully. WTW says bodily injury cover under cyber policies is customarily limited to mental anguish and emotional distress. Healthcare professional liability may respond, subject to its own data exclusions.

Who conducted the study?

Ponemon Institute, sponsored by Proofpoint. It surveyed 705 IT and IT security practitioners in May 2026. Forty percent work at healthcare providers and 39 percent at health insurers or payers.

Martin Hinton
Martin Hinton is the Executive Editor and Publisher of Cyber Insurance News and Information. With over three decades of journalism experience across six continents, his work encompasses investigative reporting, documentaries, and coverage of cultural, political, and business news. To learn more about his career, click on his name to visit his LinkedIn page.

Leave a Comment

×