Blog Cybersecurity
Healthcare Cyberattacks Disrupt Patient Care, Report Finds
On this page· 7 sections
A report released on October 13, 2026 by Proofpoint and the Ponemon Institute found that 97% of the US healthcare organizations surveyed had faced at least one cyberattack in the past 12 months, and that 74% of them reported disruption to patient care. The finding shows that healthcare cyberattacks reach the bedside, not only the servers.
Key findings and attack types
The fifth edition of Cyber Insecurity in Healthcare draws on responses from 705 IT and IT security practitioners at US healthcare organizations, according to Proofpoint’s press release. The average organization dealt with 51 attacks over the year, up from 43 in the 2025 edition.
The effect on care varies by attack type. Among organizations hit by supply chain attacks, meaning attacks that come through a vendor or third-party provider, 90% reported disrupted care, up from 87% in 2025. Among those hit by ransomware, the figure was 72%, up from 67%. The HIPAA Journal also reports that 65% saw disruption after cloud or account compromises.
Ransomware is malicious software that locks data or systems and demands payment to release them. Business email compromise uses fake emails that appear to come from a colleague or partner to prompt a payment or access. The report also describes what the disruption looks like. Among ransomware victims that reported disruption, 70% said patients stayed longer in care. For business email compromise, 68% pointed to delayed procedures and tests. Across all attack types, 53% of respondents reporting disruption cited more complications in medical procedures, while 52% cited longer stays and 52% cited delayed tests or procedures.
Data loss is part of the picture. Organizations in the survey averaged 21 incidents of sensitive health data being lost or stolen over two years. Some 54% said these incidents disrupted patient care, and employee negligence was the leading cause.
The cost of attacks and ransoms
The average cost of a respondent’s most expensive attack rose nearly 8%, from $3.9 million to $4.2 million. The largest component was disruption to normal operations, at an average of $1.39 million, followed by idle time and lost productivity at $1.05 million.
The share of victims paying ransoms edged down. Of the organizations hit by ransomware, 31% paid, compared with 33% a year earlier, and the average costliest ransom fell from $1.2 million to $1.1 million. Care disruption from ransomware still rose, which suggests that refusing to pay does not help much if systems cannot be restored quickly.
Ryan Kalember, Proofpoint’s Chief Strategy Officer, said “Cyber resilience has become essential to healthcare resilience”. He also described cyber risk as patient risk. The report was prepared with a security vendor and rests on respondents’ own answers rather than independent measurement, and the press release does not detail how the sample was drawn.
AI adds new risks inside hospitals
Another section covers AI adoption. About 45% of organizations have embedded AI, either in cybersecurity or in both cybersecurity and patient care, and another 30% plan to. Yet 60% lack controls over sensitive data used in AI systems, and only 32% say they have full visibility into how AI tools are used in their organization.
Their top concerns are vendor supply chain risk (40%), data leaking through prompts (36%) and AI-generated phishing (34%). Unguarded AI agents were named as a cause of data loss by 24% of respondents. The same report finds that 35% of organizations have moved clinical applications to the cloud, with 44% more planning to within two years.
These figures come from US hospitals and clinics. Readers in Indonesia should not read them as local statistics, but the pattern carries over: the more clinical systems connect to the cloud, vendors and AI, the more entry points there are to protect.
What this means for hospitals and clinics
In Indonesia, health data counts as personal data under Law No. 27 of 2022 on Personal Data Protection (the PDP Law). Healthcare providers must protect that data and keep services running at the same time. For the national medical records rollout, see our article on SATUSEHAT EMR and JKN claims, and for AI and patient data, our piece on Nvidia and Doctolib.
- Map the systems that support care. List medical records, laboratory, radiology, pharmacy and scheduling, then decide the recovery order if they all go down together.
- Prepare manual procedures. Nurses and staff should know how to record, prescribe and call patients when systems are unavailable, and should rehearse it regularly.
- Set permissions for AI tools. Decide which tools staff may use, what data must never be entered into them, and who monitors their use.
- Review vendors. In this survey, supply chain attacks caused disruption most often. Ask application and device providers how they secure their access to your systems.
- Test recovery. A backup only helps if it can be restored within an agreed time. Keep a copy at a separate location and test it routinely.
- Train staff. Because employee negligence was the leading cause of data loss, training on phishing and data handling remains important.
The measure of success for these drills is simple: how long core services take to return, and whether staff know what to do while they wait.
A small clinic can start more simply: a list of the systems used every day, who holds administrator access, and where backups are kept. Larger hospitals can move on to simulated outage drills involving clinical staff and the IT team together. Merakit’s cybersecurity services can help with monitoring and recovery planning, and the sector’s needs are covered on the healthcare solutions page.
Frequently asked questions
Does the 74% figure apply to hospitals in Indonesia?
No. It comes from a survey of 705 practitioners at US healthcare organizations. The report is useful as a picture of attack patterns, but its percentages cannot be transferred directly to Indonesia.
Why can a cyberattack lengthen a patient’s stay?
According to the report, 70% of ransomware victims that reported disruption said stays became longer. The press release does not explain the mechanism, but outages in medical records, laboratory or scheduling systems generally slow examinations and clinical decisions.
Does paying a ransom solve the problem?
The report does not say so. Only 31% of ransomware victims paid, while 72% reported disrupted patient care. Tested recovery and well-rehearsed manual procedures still determine how quickly services return to normal.
Conclusion
The Proofpoint and Ponemon report shows that cyber incidents in healthcare are felt by patients as delayed tests, longer stays and stalled procedures. The most useful preparation is what can be rehearsed before an incident: a system map, manual procedures, rules for AI use and recovery that has actually been tested. If your organization wants to assess that readiness, the Merakit team is glad to talk.
