Health IT security staff reported an average of 51 attacks in the past year, up from 43 the year before.

 

What happened

Supply chain attacks, where attackers reach an organization through a supplier or vendor, had the greatest effect on care, according to the survey’s published findings. Among respondents hit by one, 90% said patient care was disrupted, up from 87% in 2025. Ransomware disrupted care for 72% of those affected, up from 67%, and 70% of that group cited longer patient stays. Cloud and account compromises, which ran as high as 20 per organization on average, disrupted care for 65%. Data loss caused problems as well, with 54% saying those incidents disrupted patient care, and more than half of that group reporting increased mortality rates. Downtime and recovery carried the greatest financial cost.

 

Going deeper

Supply chain attacks, where attackers reach an organization through a supplier or vendor, had the greatest effect on care. Among respondents hit by one, 90% said patient care was disrupted. Ransomware disrupted care for 72% of those affected, and the most common result among them was longer patient stays. Business email compromise disrupted care for 69%, often through delays to procedures and tests, while cloud and account compromises disrupted care for 65%. Organizations also reported an average of 21 incidents where data was lost or taken from inside, and a majority of respondents said those incidents affected patient care too. Disruption to business operations was the highest single cost, averaging $1.39 million per incident.

 

What was said

"Unfortunately, hundreds of ransomware attacks against hospitals and our mission-critical third parties have shown us that we need to be prepared to deliver safe and quality care for 30 days or longer without the benefit of connected technology," said John Riggi, national advisor for cybersecurity and risk at the American Hospital Association, in comments to Becker's Hospital Review. Riggi said third-party risk remains underestimated, and that federal agencies now treat ransomware attacks that delay care as threat-to-life crimes rather than data crimes.

 

In the know

AI is moving into healthcare operations faster than many organizations have set rules for it. About 45% of respondents said their organizations had embedded AI in cybersecurity, or in both cybersecurity and patient care, and another 30% planned to, according to the survey’s published findings. Respondents’ leading AI-specific concerns were supply chain risk from AI vendors at 40%, data leaking through prompts typed into AI tools at 36%, and AI-generated phishing and social engineering at 34%.

 

The big picture

The survey's findings point to the same conclusion as the AHA's planning guidance: hospitals need to be able to keep treating patients when their systems are down. The Joint Commission and the AHA launched a Cyber Resilience Readiness program in May 2026, according to the Joint Commission, with a self-assessment tool aimed at keeping care safe during a cyber disruption rather than at IT recovery alone. The program was built from lessons learned in real ransomware attacks on hospitals. With supply chain attacks causing the most disruption in the survey, the planning has to include what happens when a vendor's system fails, not only the hospital's own.

 

FAQs

What is a supply chain attack?

An attack that reaches an organization through a supplier, vendor, or service it relies on, rather than through its own systems directly.

 

Why does business email compromise affect patient care?

It can divert payments to suppliers, disrupt scheduling, or tie up staff dealing with the fallout. Survey respondents most often linked it to delays in procedures and tests.

 

Who conducted the survey?

The Ponemon Institute, a research firm, surveyed 705 IT and IT security practitioners at US healthcare organizations in May 2026 on behalf of a security company.

 

What does clinical continuity planning involve?

Deciding in advance how care will continue without electronic records, ordering systems, or other technology, including paper workflows, communication methods, and which services to divert.

 

How should hospitals plan for a vendor outage?

Identify which vendors' systems care depends on, what the manual fallback is for each, and how quickly the vendor must report an outage. The AHA recommends planning for disruptions lasting 30 days or longer.