Report: Cyber attacks costs US healthcare system $6B annually; nearly 90% of healthcare providers were hit by breaches in the past two years
Rising Cyber Attacks Costing Health System $6 Billion Annually — A rise in cyber attacks against doctors and hospitals is costing …
Context & Ripple Effects
This 2015 report — a $6B annual cost and breaches hitting nearly 90% of US providers — reads as an early baseline for a problem that has since compounded. HHS data shows exposed patient records climbing from 26M people in 2020 to 40M+ in 2021, and Omdia found healthcare suffered more publicly disclosed cyberattacks than any other sector in the first nine months of 2023.
The arc runs from data theft to operational shutdown: ransomware against hospitals doubled in the EU's 2020 count, the NHS's series of hacks exposed structural fragility across a system caring for 68M residents, and UnitedHealth's Change Healthcare attack alone cost $872M in a single quarter. The 2015 figure captured breach costs; the later record captures care delivery itself being held hostage.
First-order effects
- US providers face direct remediation, downtime, and breach-response costs that aggregate to $6B annually per this report, with nearly 90% already hit at least once in two years.
Second-order effects
- Payers and vendors inherit provider fragility through connected claims systems — the pattern later visible when a ransomware attack on Change Healthcare cost UnitedHealth $872M in one quarter, with a second group moving in to extort the same victim.
Third-order effects
- As attacks shift from records theft to shutting down operations, the stakes move from compliance fines to clinical harm — a trajectory the corpus documents in 22% of providers reporting higher patient mortality after cyberattacks, pointing toward security becoming a patient-safety requirement rather than an IT line item.
The trend: Healthcare cybersecurity is escalating from episodic data breaches toward systemic operational risk, with each year's incident count and cost setting a higher baseline than the last.