US healthcare organizations reported 622 large data breaches from January 1 to October 15, 2026, affecting 87.7 million people.
That is slightly fewer breaches than in the same months of 2025, and far fewer people.
Every number on this page comes from public records. We downloaded all 8,077 breach reports that the US Department of Health and Human Services (HHS) has published since 2009, both the open cases and the archive, and analyzed them ourselves. Each report covers a breach of health information affecting 500 or more people.
We also added the FBI’s ransomware data, cost studies, every HIPAA enforcement action announced in 2025 and 2026, and healthcare fines from our own GDPR fines tracker for Europe. You can download our cleaned dataset at the end.
Data as of November 9, 2026. The newest report on the HHS portal was filed on October 15, 2026.
- 622 large healthcare data breaches were reported to HHS from January 1 to October 15, 2026, affecting 87.7 million people: 5% fewer breaches and 36% fewer people than in the same period of 2025.
- 2025 set the record with 811 breaches, more than two a day.
- Since 2009, the reports add up to 1.1 billion affected records, more than three for every person in the US.
- Hacking caused 86% of 2026 breaches and 98% of the affected records. In 2010 it caused 4% of breaches.
- Vendors (business associates) were involved in 35% of 2025 breaches but 64% of the people affected. The largest 2026 breach, DentaQuest, affected 15 million.
- Healthcare reported more ransomware attacks to the FBI in 2025 than any other critical infrastructure sector: 460.
- HIPAA penalties shrank: 12 actions worth $3.97 million in 2026 so far, against 21 worth $8.33 million in 2025. One company paid $10,000 over a breach of 15 million people.
- In Europe, our GDPR tracker counts 238 fines against healthcare organizations (€34.1 million); 2026 is the biggest year so far, at €14.1 million.
Source: Privacy Affairs · 2026-11-09