Real incidents. Real patient impact. Real framework gaps. Every entry represents real patients — whether their care was disrupted or their most sensitive records were exposed. Attacks on healthcare are attacks on human life, not just data.
Most trackers count records breached. This one asks what happened to patient care. Each incident is scored only on care-disruption factors a public report actually confirmed — emergency diversion, cancelled treatment, EHR downtime, paper charting, multi-facility spread, documented patient-safety impact — weighted by clinical triage priority. A data-only breach scores zero on continuity no matter how many records leaked; that gap between records lost and care disrupted is the point. — Chaunda C. Dallas, DFR Framework
Attacks on healthcare businesses — vendors, MSPs, billing providers — surged 30% in 2025. Hitting one vendor cascades disruption across hundreds of providers at once.
For the first time in three years, exploited vulnerabilities (33%) passed credential-based attacks as the leading technical root cause.
In H1 2026, Qilin and The Gentlemen led healthcare ransomware claims, with INC Ransom and NightSpire most active against healthcare businesses. Since July, ShinyHunters has run extortion-only data theft against healthcare vendors: DentaQuest, then McKesson.
Health-sector security pros now rank AI-enabled attacks as the top threat for 2026 — surpassing ransomware for the first time.
Kettering was breached April 9, triggered May 20 — six weeks undetected. Early detection remains the highest-impact defensive investment.
The frameworks this lab reviews give little attention to the clinical continuity dimension — what happens to patients during downtime. HIPAA, NIST, and HHS 405(d) protect data, not care delivery. That's the gap this lab documents.
A healthcare organization or healthcare business (vendor, billing, benefits, lab, distributor) with a confirmed cyber incident that either disrupted care or exposed patient or workforce data at scale, and a public source that can be cited. Unconfirmed leak-site claims alone don’t qualify.
1. The organization’s own notice or regulatory filing. 2. The HHS OCR breach portal and state attorney general filings. 3. Established trade reporting (HIPAA Journal, Becker’s, Cybersecurity Dive) and major news. 4. Researcher or threat-intel claims, labeled as claims.
Dataset last reviewed September 26, 2026. Entries are rechecked when a count is revised or new details are disclosed, and the revision is noted in the entry.
Care-disruption factors (diversion, interrupted treatment, cancelled procedures, EHR downtime, paper charting, pharmacy or imaging loss, multi-facility spread, extended downtime) are recorded only when a public report confirms them. They feed the Clinical Continuity Score above. Data-only incidents score zero by design.
The date shown is the month the incident was publicly disclosed or first reported, unless the entry says otherwise. Intrusion dates, when known, are given in the incident description, because the gap between the two is often part of the story.
Counts come from the organization’s notice or HHS OCR where available. Estimates, researcher counts and attacker claims are labeled as such next to the number. “Count undisclosed” entries are listed with zero and excluded from the totals.