New survey finds healthcare cyberattacks negatively impact patient care

Proofpoint Inc. announced the publication of findings from their most recent survey with Ponemon Institute on cybersecurity in healthcare. Key findings from “Cyber Insecurity in Healthcare: The Cost and Impact on Patient Safety and Care 2025” are summarized in a press release.

The survey found healthcare cyberattacks negatively impact patient care and sometimes raise mortality. Additional findings from 677 healthcare IT and cybersecurity respondents based in the U.S.:

• Healthcare cyber incidents are rising and becoming more frequent. Most respondents reported that their organization was the target of “at least one cyberattack in the past year,” but the number of attacks per organization averaged at 43.
• The financial burden of ransomware attacks on healthcare organizations is rising.
• Supply chain attacks were found to be the most likely to negatively impact patient care, but cloud/account compromises resulted in patient deaths for 36% of victim organizations.
• Nearly all (96%) of surveyed organizations reported “at least two incidents of data loss or exfiltration involving sensitive and confidential healthcare data over the past two years.” More than half of participants reported observing disruptions in patient care due to this.
• Employee error caused 60% of data loss. Privileged access abuse was the second highest cause of data loss (25%).
• 5% more organizations are working to improve employees’ cybersecurity awareness than last year.
• “Insecure mobile apps (eHealth) remain the top cyber concern (55%), followed by employee-owned mobile devices (49%) and cloud/account compromise (49%).”
• The top three communication methods targeted are: text messaging, videoconferencing, and email.
• More than half of organizations (57%) reported using artificial intelligence (AI) in cybersecurity and/or patient care.

Ryan Witt, vice president of industry solutions at Proofpoint emphasized in a press release, “Patient safety is inseparable from cyber safety. This year’s report highlights a stark reality: cyber threats aren’t just IT issues, they’re clinical risks. When care is delayed, disrupted, or compromised due to a cyberattack, patient outcomes are impacted, and lives are potentially put at risk. This report underscores the urgent need for healthcare organizations to adopt a human-centric cybersecurity approach—one that not only protects systems and data but also preserves the continuity and quality of care.”