Healthcare cybersecurity: Proofpoint’s patient-care findings
Proofpoint and the Ponemon Institute have released the fifth annual Cyber Insecurity in Healthcare report, based on a survey of 705 IT and IT-security practitioners at U.S. healthcare organisations. It found that 97% of those organisations experienced at least one cyberattack in the past 12 months, and that 74% of those affected reported disruption to patient care. The average number of healthcare cybersecurity attacks rose to 51 from 43 a year earlier, and the average cost of the most expensive attack rose nearly 8% to US$4.2 million.
Those are striking figures, and the direction of travel they describe — more attacks, higher costs, more care disruption — is consistent with the wider evidence. But the most alarming number in the report deserves particular care, because it is a perception rather than a measurement, and because stronger independent evidence exists for the same concern. Surveys of this kind are useful as a temperature check, not a diagnosis. They capture what practitioners see and fear, which shapes budgets and board attention; they cannot, by design, prove causation.
That distinction matters especially in healthcare cybersecurity, where the consequences under discussion are clinical, not merely financial, and where the evidence bar should be correspondingly higher than in other sectors.
The mortality question
The release states that organisations experienced an average of 21 data-loss or exfiltration incidents over two years, that 54% of these disrupted patient care, and that “among that group, 56% reported increased mortality rates.” That is a serious claim, and it is worth reading precisely: it is the share of respondents who reported a rise in mortality, not a measured change in patient outcomes. The survey, as independent coverage notes, does not measure patient outcomes at all. That is a limitation worth naming plainly, because the figure travels further than its method supports.
When a survey number repeats without the caveat that it reflects belief rather than measurement, it can harden into a claim the underlying data cannot carry — and healthcare cybersecurity, where the stakes are clinical, is precisely where that kind of slippage does the most damage. Its respondents also reach well beyond hospitals — only 40% work at healthcare providers, with 39% at insurers or payers and 21% at life-sciences firms.
So the honest reading is that a majority of a self-selected group of healthcare IT and security professionals believe cyber incidents contributed to patient deaths. That is meaningful as a signal of practitioner concern. It is not, on its own, evidence of a mortality effect. For a claim this serious, that distinction is not academic.
Why the numbers are plausible
Fortunately, there is peer-review evidence that tests the same proposition far more rigorously — and it broadly supports the concern. A study by Hannah Neprash, Claire McGlave and Sayeh Nikpay, published in the American Economic Journal: Economic Policy in February 2026, built a database of hospital ransomware attacks and linked it to Medicare claims. It found that ransomware cut hospital volume by 17–24% in the initial attack week, recovering within about three weeks, and that in-hospital mortality among patients already admitted when an attack began rose by 34–38%.
The Medicare-claims method is worth explaining, because it is why the finding carries weight. The researchers restricted the mortality measure to patients admitted before an attack began, which removes the possibility that the hospital was simply receiving sicker cases during the disruption, and compared attacked hospitals against a control group of hospitals that would be attacked at least five weeks later. The result — a 34–38% rise in in-hospital mortality for already-admitted patients — is the strongest available estimate, though it covers Medicare fee-for-service patients and therefore skews older. It remains the most credible healthcare cybersecurity evidence available on the mortality question.
Running at Reduced Capacity
It also shows the mechanism clearly: a hospital running at reduced capacity diverts ambulances, postpones procedures and works without imaging or laboratory systems while staff reconstruct medication histories on paper. The peer-reviewed JAMA Health Forum analysis adds scale: 374 ransomware attacks on US healthcare organisations between 2016 and 2021, 44.4% of which disrupted care delivery for an average of 15.8 days, exposing the health information of nearly 42 million patients. Taken together, the peer-reviewed record supports the survey’s direction of travel while showing that its headline harms are best understood through measured outcomes rather than respondent estimates. The exposure figure is the other half of the story: when nearly 42 million patients’ records are exposed over six years, the privacy and identity consequences extend well beyond any single incident.
Against that backdrop, the Proofpoint–Ponemon findings read less as a novel alarm and more as confirmation that the pressure has not eased. The study has tracked care disruption rising from 69% in 2024 to 72% in 2025 and now 74%. Its largest cost category this year is operational disruption, at US$1.39 million, ahead of idle time and lost productivity at US$1.05 million — a shift that underlines the report’s central argument: in healthcare, cyber risk becomes patient risk.
The AI governance gap
The report’s second theme is AI. It found that 45% of organisations have embedded AI in cybersecurity or in both cybersecurity and patient care, while another 30% plan to adopt it — and that governance has not kept pace. Sixty per cent lack controls governing sensitive data used in AI systems, only 42% use security measures designed for AI systems and agents, and just 32% have full visibility into employees’ use of unsanctioned AI tools. For the first time, respondents identified AI agents operating without guardrails as a cause of data loss, cited by 24%.
These findings align with independent benchmarks rather than standing alone. Clearwater’s 2026 Healthcare AI Security and Governance Benchmark found that 91% of healthcare organisations cannot verify what AI is actually running in their environments, and that only about four in ten can demonstrate control over how data is sent to AI tools. Kiteworks’s 2026 analysis found healthcare trails global averages on nearly every AI technical control, and a 2025 IBM study found that 97% of organisations experiencing an AI-related security incident lacked proper AI access controls.
The pattern is consistent: adoption is outrunning governance, and the same finding appears whether a security vendor, a compliance firm or a research institute runs the survey. The release’s framing — that organisations need security built around the interactions between people, data and AI — reflects where the evidence points.
What to watch
For healthcare security leaders, the actionable signals are the AI-governance gaps: data controls for AI systems, visibility into unsanctioned tools, and guardrails for AI agents. For the wider sector, the question is whether the cost curve keeps rising as cloud adoption expands — 35% of organisations have moved clinical applications to the cloud, up from 30%, with another 44% planning to within two years, and cloud or account compromises disrupted care for 65% of respondents. And for readers, the useful discipline is to treat vendor-sponsored surveys as directional and peer-reviewed outcome research as decisive — especially on a question as consequential as patient mortality. For healthcare cybersecurity teams, the practical takeaway is to build the governance that the report shows is missing: inventories of AI tools and agents, controls on the data that reaches them, and a way to switch access off.
That work is unglamorous, but it is the difference between adopting AI and governing it. The pressure is not easing; the report’s own trend line shows that clearly. There is also a governance-incentive question. The report notes that cloud adoption is expanding and that account compromise is the most prevalent vector, yet many organisations still lack visibility into unsanctioned AI tools and controls over data entering AI systems. Closing that gap is less about buying another product than about treating AI as a governed part of clinical operations — knowing what is running, who can access patient data, and how to revoke access when something changes. That is the discipline healthcare cybersecurity now demands.
What the report does and doesn’t establish
For healthcare cybersecurity, it establishes that attacks are more frequent and costlier, that care disruption is rising, and that AI governance lags adoption. It does not establish a measured mortality effect — the survey does not measure outcomes — and it offers no India-specific data, despite the release carrying an India dateline. The sample is U.S.-only and skewed toward payers and life sciences alongside providers. What it does show is where the pressure is building: operational disruption as the dominant cost, supply chain attacks as the sharpest threat to care, and AI as a fast-growing source of unmanaged risk.
The honest summary is that Proofpoint and Ponemon have documented a real and worsening problem, and independent benchmarks corroborate their AI-governance findings. But the report’s most quoted number — the mortality figure — is a perception, not a measurement. The peer-reviewed evidence that ransomware raises mortality among admitted patients by 34–38% is the firmer basis for the same conclusion, and it is the one readers should weigh.
Editor’s Note: This article draws on the Proofpoint–Ponemon release and report, peer-reviewed research by Neprash, McGlave and Nikpay in the American Economic Journal: Economic Policy (February 2026), the JAMA Health Forum ransomware analysis, and independent AI-governance benchmarks from Clearwater and Kiteworks. The survey figures, including the mortality claim, are self-reported and the study does not measure patient outcomes; no India-specific data was disclosed. No interview was conducted.