Insights · Healthcare
Healthcare Data Breaches: What 17 Years of HHS Breach Reports Tell Leaders
An executive read of 8,074 breach reports filed with the U.S. Department of Health and Human Services from October 2009 to October 2026: how often large breaches happen, what causes them, and where the impact concentrates.
- 8,074breach reports since Oct 2009
- 1.1Bindividuals affected, as reported*
- 81%of 2025 breach reports were hacking/IT incidents
- 765breach reports a year on average, 2023–2025
* Totals add up individuals affected as reported for each breach report; the same person can be counted in more than one report.
Four takeaways
-
Large breaches are now routine.
Breach reports involving 500 or more people averaged 765 a year in 2023–2025, nearly 4 times the 2010–2012 average of 205.
Board questionIs our incident readiness planned for an event we are likely to face, rather than a rare one?
-
Hacking has replaced lost and stolen devices as the main cause.
Hacking/IT incidents were 4% of breach reports in 2010 and 81% in 2025. Reports classed as hacking account for 91% of all individuals affected in the record.
Board questionDo our cyber priorities and investment reflect that shift?
-
A few incidents drive most of the impact.
The 10 largest breach reports account for 38% of all individuals affected reported since 2009 (about 1.1 billion). The median report listed 4,027 people.
Board questionHave we rehearsed a large, prolonged incident, including clinical and financial continuity?
-
Vendors carry a large share of the exposure.
Reports involving a business associate (filed by one, or noting one was present) were 30% of breach reports but 56% of individuals affected (47% excluding the 2024 Change Healthcare breach). The definition matters: reports filed by business associates alone were 15% of reports and 49% of individuals.
Board questionDo we know which vendors hold our patients’ data, and how quickly they must tell us about an incident?
Chart 1Breach reports per year
Breach reports rose from 199 in 2010 to 809 in 2025, the highest full year; 2026 is partial (623 reports posted through Oct 15, versus 656 in the same period of 2025).
* Partial year: 2009 starts with the breach notification rule (first posted submission Oct 21, 2009); 2026 runs through the latest posted submission (Oct 15, 2026). Line shows the 3-year average of full years.
View data table
| Year | Breach reports | 3-year average | Individuals affected |
|---|---|---|---|
| 2009* | 18 | 134,773 | |
| 2010 | 199 | 5,932,276 | |
| 2011 | 200 | 13,162,158 | |
| 2012 | 217 | 205 | 2,853,985 |
| 2013 | 277 | 231 | 7,018,839 |
| 2014 | 314 | 269 | 19,073,551 |
| 2015 | 270 | 287 | 112,466,720 |
| 2016 | 328 | 304 | 16,711,004 |
| 2017 | 357 | 318 | 5,313,246 |
| 2018 | 369 | 351 | 15,256,235 |
| 2019 | 511 | 412 | 44,969,724 |
| 2020 | 663 | 514 | 35,321,223 |
| 2021 | 715 | 630 | 61,206,238 |
| 2022 | 718 | 699 | 64,570,326 |
| 2023 | 745 | 726 | 183,256,225 |
| 2024 | 741 | 735 | 290,088,141 |
| 2025 | 809 | 765 | 141,744,021 |
| 2026* | 623 | 87,707,918 |
Chart 2What kind of breach: share by type each year
Theft was the most common breach type every year through 2014; hacking/IT incidents have been the largest category every year since 2017, reaching 81% of breach reports in 2025.
* 2026 is a partial year. Reports listing more than one type are shown as “Multiple types”; “Other”, “Unknown” or blank as “Other or unknown”. From 2015 on, every report in the portal lists exactly one of the five main types, so these two groups appear only through 2014. Percentages may not total 100 because of rounding; a share shown as 0% can still include a few reports (under 0.5%).
View data table
| Year | Hacking/IT incident | Unauthorized access/disclosure | Theft | Loss | Improper disposal | Multiple types | Other or unknown |
|---|---|---|---|---|---|---|---|
| 2010 | 4% | 5% | 65% | 7% | 4% | 4% | 11% |
| 2011 | 8% | 14% | 57% | 8% | 3% | 6% | 5% |
| 2012 | 5% | 13% | 56% | 8% | 3% | 10% | 6% |
| 2013 | 10% | 23% | 43% | 7% | 4% | 6% | 6% |
| 2014 | 11% | 28% | 36% | 6% | 3% | 9% | 7% |
| 2015 | 21% | 38% | 30% | 9% | 2% | 0% | 0% |
| 2016 | 35% | 40% | 19% | 5% | 2% | 0% | 0% |
| 2017 | 42% | 35% | 15% | 4% | 3% | 0% | 0% |
| 2018 | 45% | 38% | 11% | 4% | 3% | 0% | 0% |
| 2019 | 61% | 27% | 7% | 3% | 1% | 0% | 0% |
| 2020 | 69% | 21% | 6% | 2% | 2% | 0% | 0% |
| 2021 | 76% | 18% | 3% | 1% | 1% | 0% | 0% |
| 2022 | 79% | 16% | 3% | 2% | 1% | 0% | 0% |
| 2023 | 81% | 16% | 2% | 1% | 1% | 0% | 0% |
| 2024 | 83% | 15% | 2% | 1% | 1% | 0% | 0% |
| 2025 | 81% | 18% | 1% | 0% | 0% | 0% | 0% |
| 2026* | 85% | 14% | 0% | 0% | 0% | 0% | 0% |
Chart 3Typical size by where the information was held
Breach reports involving network servers had the largest typical size, a median of 9,967 individuals, compared with 1,500 for paper and films.
Median individuals affected per report. A report listing several locations counts under each. Locations with fewer than 50 reports are not shown.
View data table
| Location | Breach reports | Median individuals affected |
|---|---|---|
| Network Server | 3,739 | 9,967 |
| 1,867 | 3,290 | |
| Electronic Medical Record | 478 | 2,869 |
| Other | 474 | 2,561 |
| Desktop Computer | 384 | 2,367 |
| Laptop | 516 | 2,300 |
| Other Portable Electronic Device | 332 | 2,285 |
| Paper/Films | 1,014 | 1,500 |
Chart 4Business associates: share of breach reports vs. share of people affected
Business associates were involved in 30% of breach reports but 56% of individuals affected (47% excluding the 2024 Change Healthcare breach); counting only reports they filed, the shares are 15% and 49%.
“Involved” means the reporting entity is a business associate, or the report says a business associate was present. The definition drives the number: counting only reports filed by business associates gives 15% of breach reports and 49% of individuals affected (see the data table).
View data table
| Measure | Business associate involved | Not involved |
|---|---|---|
| Share of breach reports | 30% | 70% |
| Share of individuals affected | 56% | 44% |
| Share of individuals affected, excluding the 2024 Change Healthcare breach | 47% | 53% |
| Median individuals affected per report | 4,473 | 3,882 |
| Number of breach reports | 2,426 | 5,648 |
| Definition | Breach reports | Share of breach reports | Share of individuals affected | Excl. 2024 Change Healthcare breach |
|---|---|---|---|---|
| Filer is a business associate, or one was present (used on this page) | 2,426 | 30% | 56% | 47% |
| Filer is a business associate | 1,241 | 15% | 49% | 38% |
| “Business associate present” flag | 2,418 | 30% | 56% | 46% |
| Both | 1,233 | 15% | 49% | 38% |
Chart 5Where breach reports are filed
California has the most breach reports (792); by individuals affected, Minnesota leads (212 million), mostly from Change Healthcare’s 2024 breach (193 million individuals), which was reported there.
State of the reporting entity, not where affected individuals live. Indiana ranks 2nd by individuals affected (93 million, including 79 million from Anthem’s 2015 breach) and 12th by number of breach reports (206).
View data table
| Rank | By breach reports | Breach reports | By individuals affected | Individuals affected |
|---|---|---|---|---|
| 1 | California | 792 | Minnesota | 212,244,014 |
| 2 | Texas | 659 | Indiana | 93,126,604 |
| 3 | New York | 522 | California | 89,175,035 |
| 4 | Florida | 478 | New Jersey | 79,985,058 |
| 5 | Illinois | 365 | Florida | 54,215,253 |
| 6 | Pennsylvania | 347 | Texas | 49,911,723 |
| 7 | Ohio | 281 | New York | 42,953,078 |
| 8 | Massachusetts | 245 | Tennessee | 40,062,379 |
| 9 | Michigan | 241 | Georgia | 38,872,383 |
| 10 | Georgia | 231 | Colorado | 29,625,843 |
About the data
- Source: the HHS Office for Civil Rights breach portal, combining the “Under Investigation” list (722 reports from the last 24 months) and the Archive (7,356 reports). Exported November 10, 2026 at 8:16 AM Arizona time; 4 exact duplicate rows removed, leaving 8,074 breach reports.
- The portal lists breaches of unsecured protected health information affecting 500 or more individuals, as reported by HIPAA covered entities and business associates.
- Counts are breach reports, not incidents. One vendor incident can lead many affected organizations to file separate reports, while others are filed as one consolidated report (Change Healthcare’s 2024 breach is a single report).
- Years are based on the date a breach report was submitted to HHS, not when the breach occurred or was discovered.
- Recent periods are incomplete. 2009 starts with the breach notification rule (effective September 2009). 2026 runs through the latest posted submission (Oct 15, 2026), and reports can take weeks to appear, so the most recent months undercount.
- Counts change after the fact. Reports keep arriving after year-end and HHS revises counts, so tallies published at other times (for example, year-end figures released in January) will differ, usually showing fewer reports. Our 2025 figures (809 breach reports, about 142 million individuals affected) are as of the November 10, 2026 export.
- Individuals affected are the counts reported by each organization and can be revised later. Adding them up counts a person once for each breach that affected them.
- State is the reporting organization’s state, not where affected individuals live.
- Breach type: a report listing one type keeps it; a report listing more than one type counts as “Multiple types” (86 reports); “Other”, “Unknown” or blank counts as “Other or unknown” (86). From 2015 on, every report in the portal lists exactly one of the five main types, so those two groups appear only in 2009–2014. Hacking figures count reports whose only listed type is hacking/IT incident. A report listing several locations counts under each location.
- Business associate share depends on the definition. This page counts a report if the filer is a business associate or the report says one was present (2,426 reports: 30% of breach reports, 56% of individuals affected). Counting only reports filed by business associates gives 15% and 49%. The “business associate present” flag alone covers almost the same reports (2,418), so it also rounds to 30% and 56%.
- Figures are rounded to whole numbers: percentages and millions are calculated from exact counts and rounded once, half up (the all-time total is shown as about 1.1 billion). Rows may not total 100% because of rounding, and recombining rounded figures can give slightly different results. Counts of reports and individuals are exact.
Want a clear read on what this means for your organization?
Standing Watch Advisory helps boards and executives in healthcare and financial services turn cyber and vendor risk into decisions they can oversee with confidence.
Start a conversation