2025 in Health Data Breaches and Predictions for 2026

A Year of Industrialized Cybercrime Targeting Healthcare Marianne Kolbasuk McGee (HealthInfoSec) • December 30, 2025

This year has not - as far as we know - broken any health data breach records. There were plenty of large data thefts over the past 12 months, disruptive ransomware attacks and compromises affecting scores of patients. But nothing approached the scale of the February 2024 ransomware attack on UnitedHealth Group's Change Healthcare unit, which affected 193 million individuals.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

If 2025 lacked a signature attack, hundreds of hospitals, health systems, clinics, physician practices, business associates and other vendors nonetheless experienced breaches in 2025 that cumulatively affected tens of millions of Americans.

As of earlier this month, the U.S. Department of Health and Human Services' Office for Civil Rights listed 605 reported breaches affecting about 44.3 million people.

The ...