Large-Scale U.S. Healthcare Data Breaches Surge in Victim Count — 2026 Statistics

HIPAA Journal compiled statistics on large (500 or more) healthcare data breaches from data released by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), covering the period from October 21, 2009, to August 25, 2026. The article was updated on October 15, 2026, and based on OCR data (as of October 10, 2026) it summarizes that 2026 was a year in which 772 large breaches were reported.

The statistics point out recent trends: the number of breaches doubled between 2018 and 2021, and since 2020 there has been a particularly notable surge in the number of victims. For example, the 2024 ransomware attack on Change Healthcare affected 192,700,000 people, a figure that far exceeds previous records. Large incidents continued in 2025 as well, with about 62,220,000 records at Conduent Business Services and about 14,000,000 at Aflac.

By cause, past incidents often involved loss/theft or misdelivery, but in recent years hacking and other IT-related incidents have become dominant. OCR aggregation shows a marked increase in hacking-related incidents from 2018 to 2023, and as of 2023 about 79.7% were attributed to hacking. The article also notes that reports of small breaches (fewer than 500) have increased, with 74,299 small incidents reported in 2024.

Although OCR is required to investigate all large breaches, the article states that the backlog of investigations has grown in response to the rising number of reports, and that OCR needs additional funding given a flat budget. The article also reports that the prolonged U.S. government shutdown at the end of 2025 may have contributed to delays in OCR data publication.

These statistics are continually updated, and the article warns of years in which OCR's data portal has lagged in updates (notably 2026). While tables and statistics are refreshed annually, they also fluctuate month to month and include cases still under investigation, so the article advises consulting the original OCR data and HIPAA Journal pages for the latest details.