Estimated reading time: 6 minutes
Healthcare cybersecurity continues to face serious challenges, directly affecting hospitals and patient care. Following cyberattacks at Change Healthcare and Ascension, Fortified Health Security predicts that future attacks will be smaller but more frequent. The 2026 Horizon Report reviews data from January 2024 to December 2025, using information from the HHS Office for Civil Rights, NIST Cybersecurity Framework assessments, and incident response records. The report finds that resilience is now just as important as prevention in healthcare cybersecurity.
“Healthcare cybersecurity is no longer about surviving a single catastrophic event,” said Dan L. Dodson, chief executive officer at Fortified Health Security. “It’s about enduring relentless pressure.” The report describes this as ongoing operational stress instead of a one-time crisis.
Key Takeaways
- Breach volume surged in 2025, and incident pace now drives risk as much as record counts.
- Patient record exposure dropped, but repeated disruptions still drain operations and staff time.
- Email incidents spiked, and phishing plus credential misuse keep beating perimeter defenses.
- Network server compromises stayed dominant, and remote access paths remain high-value targets.
- Only 6% of organizations feel very confident in detection, containment, and recovery capabilities.
- Third-party risk alignment remains weak, and only 4% express strong confidence in vendor assessments.
- Ransomware response demands downtime planning, and paper workflows still act as a last-resort lifeline.
- Shadow AI introduces new data leakage risk, and governance must keep pace with frontline adoption.
- Continuous training delivers measurable value, and short frequent drills beat annual check-the-box modules.
- Interoperability mandates expand exposure, and API governance becomes a core security control.
- Regulatory change will raise expectations, and incident response maturity will influence cyber insurance outcomes.
Breach Volume Rises While Impact Shrinks
The report shows that breach frequency rose sharply in 2025. OCR data recorded 502 healthcare breaches that year, compared to 237 in 2024. Fortified reports this is an increase of over 100%.
Meanwhile, the total number of patient records exposed fell sharply. The report notes 35.5 million records were affected in 2025, down from about 251 million in 2024. Fortified credits this improvement to better containment and segmentation, which helped organizations limit the impact even as attacks increased.
However, this change has a downside. Smaller incidents now happen more often, and each one needs investigation, reporting, and recovery. The report calls this a “constant state of disruption” that puts pressure on teams and workflows.
Email And Network Attacks Drive Frequency
Network servers continued to be the most common place for breaches, with 305 incidents in 2025, up from 174 in 2024. Email-based breaches also increased, rising from 39 in 2024 to 123 in 2025.
Phishing, misuse of credentials, and staff errors contributed to the increase. The report says email breaches “more than doubled year-over-year” as attackers focus more on human behavior to get around security controls.
Hacking and IT incidents also rose quickly. Fortified connects this increase to exposed servers, VPNs, and remote access tools. Credential theft and ways to get around multi-factor authentication were common. Third-party access made the damage worse.
Readiness Confidence Remains Low
Even after years of investment, confidence remains very low. Only 6% of healthcare organizations feel very confident in their ability to detect, contain, and recover from a cyber incident. Fortified sees this lack of confidence as a major weakness.
The report links low confidence to staff shortages and burnout. Experienced security staff have important knowledge, but turnover causes that experience to be lost. New tools make things more complex without making the workload lighter.
Fortified warns not to rely only on technology. The report criticizes the idea of a “single fix.” It says that using many tools without proper processes can slow down response during a crisis.
Third-Party Risk Still Misaligned
Vendor risk remains a serious and ongoing problem. Only 4% of leaders surveyed are very confident that third-party risk assessments show the real level of risk. Almost one-third have no confidence, which leaves big gaps.
The report warns that having many connected healthcare organizations increases the risk of attacks. Vendors often have special access, so one breach can affect many groups. Fortified recommends stronger contract terms and ongoing monitoring.
PODCAST CLIP – CAN YOU BAN RANSOMWARE PAYMENTS?
Case Study Shows Operational Fallout
A ransomware attack at Frederick Health Medical Group shows what is at risk. The attack started on January 27, 2025, when IT staff noticed unusual network activity. Leaders shut down systems to stop the threat from spreading.
The report describes weeks of serious disruption. The emergency department stopped operating, ambulances were sent elsewhere, and staff had to use paper records. Ransomware was confirmed on February 6, making the crisis worse.
The organization later said that 934,326 patients were affected. Notifications went out about two months after the breach was found. Fortified notes that this met regulatory requirements but still put a strain on trust.
Shadow AI Emerges Inside The Perimeter
The report flags shadow AI as a rapidly growing insider threat. Clinicians and staff turn to unsanctioned AI tools to keep pace. These tools frequently evade governance, raising immediate risk.
“Shadow AI isn’t about bad actors,” wrote Preston Duren of Fortified. “It’s about smart people trying to work smarter.” The report warns that uploads to consumer AI platforms can expose sensitive data. Accuracy errors also create patient safety risks.
Fortified does not recommend banning all AI tools. The report suggests using approved, compliant alternatives and having clear rules. It says that being able to see and monitor usage is just as important as restricting it.
Training Becomes A Daily Control
Fortified says that ongoing workforce education is urgently needed. Annual training is no longer enough. The report compares cybersecurity training to hand hygiene, saying both need to be practiced every day to keep up with threats.
Get The Cyber Insurance Upload Delivered
Subscribe to our newsletter!
“If your people do not know how to recognize, resist, or report a threat, it only takes one email,” wrote Jason Stewart. The report points out that some states now require more frequent training. It recommends short, relevant lessons that address real threats.
Policy Changes Raise The Stakes
Federal programs will speed up modernization in 2026. The report highlights the Rural Health Transformation Program, which makes cybersecurity a funding priority. New CMS rules on interoperability and prior authorization will start in January 2026.
Fortified is also watching for a possible HIPAA Security Rule update in 2026. More data sharing through APIs and connected systems increases risks. The report says strong governance is urgently needed to balance these risks with innovation.
A Shift From Surviving To Enduring
The 2026 Horizon Report highlights several key points: daily cyber incidents are now a bigger and more constant threat than rare large breaches. Resilience and preparedness are essential, and success depends more on strong teams, good processes, and ongoing readiness.
In summary, the report emphasizes that healthcare cybersecurity needs ongoing resilience and adaptability. Organizations should focus on handling constant pressure, not just on surviving rare, major crises.
Related Cyber Insurance Posts
- Car Cybersecurity Lessons From a Russian Porsche Shutdown and Škoda’s Upstream Deal
- Munich Re Offers Virtual CISOs to Clients
- Time for Gov Agencies to Lock in Lower Cyber Insurance Costs: AON
- Cowbell Moves Upmarket with Help from Skyward
- Top Cyber Insurance Companies in the USA, According to Insurance Business America
Primary Focus Keyphrase:
Keyphrase Synonyms: hospital cybersecurity, healthcare cyber risk, HIPAA security, clinical cyber resilience, health system incident response, third-party healthcare risk
Suggested SEO Title Options:
- Healthcare Cybersecurity Faces Relentless Pressure: 9 Key Takeaways From Fortified’s 2026 Horizon Report
- Healthcare Cybersecurity Under Strain: 7 Hard Lessons From 2025’s Breach Surge
- Healthcare Cybersecurity Reality Check: 10 Data Points Driving 2026 Security Budgets
Meta Description Options:
- Fort\