Computed from HHS OCR data
Healthcare data breach statistics
Counts computed from 8,024 HIPAA breach reports in the HHS OCR breach portal export. These counts cover only HIPAA breaches affecting 500 or more individuals reported to HHS OCR, from our October 2026 export. No outside statistics are used.
Reports
8,024
2009 to 2026
Individuals affected
1,094,628,651
Sum of reported counts
Latest submission
Sep 30, 2026
Reports and individuals affected by year
| Submission year | Reports | Individuals affected | Bar |
|---|---|---|---|
| 2009 | 18 | 134,773 | |
| 2010 | 199 | 5,932,276 | |
| 2011 | 200 | 13,162,158 | |
| 2012 | 218 | 2,854,525 | |
| 2013 | 277 | 7,018,839 | |
| 2014 | 314 | 19,073,551 | |
| 2015 | 270 | 112,466,720 | |
| 2016 | 328 | 16,711,004 | |
| 2017 | 358 | 5,314,987 | |
| 2018 | 369 | 15,256,235 | |
| 2019 | 511 | 44,969,724 | |
| 2020 | 663 | 35,321,223 | |
| 2021 | 715 | 61,206,238 | |
| 2022 | 718 | 64,570,326 | |
| 2023 | 745 | 183,256,225 | |
| 2024 | 741 | 290,048,244 | |
| 2025 | 807 | 140,591,153 | |
| 2026 (partial, to 30 Sep 2026) | 573 | 76,740,450 |
Sorted by year. 2026 is partial, covering submissions up to 30 September 2026.
By type of breach
Some reports list more than one type; each type is counted once per report, so shares can sum to more than 100%.
| Type of breach | Reports | Share | Individuals affected | Bar |
|---|---|---|---|---|
| Hacking/IT Incident | 4,838 | 60.3% | 998,777,936 | |
| Unauthorized Access/Disclosure | 1,744 | 21.7% | 54,408,009 | |
| Theft | 1,060 | 13.2% | 27,220,780 | |
| Loss | 247 | 3.1% | 9,615,000 | |
| Improper Disposal | 127 | 1.6% | 2,220,170 | |
| Other | 95 | 1.2% | 1,461,610 | |
| Unknown | 16 | 0.2% | 2,246,065 |
By covered entity type
| Entity type | Reports | Share | Individuals affected | Bar |
|---|---|---|---|---|
| Healthcare Provider | 5,801 | 72.3% | 345,077,101 | |
| Business Associate | 1,232 | 15.4% | 541,944,832 | |
| Health Plan | 969 | 12.1% | 205,304,321 | |
| Healthcare Clearing House | 17 | 0.2% | 2,262,771 | |
| Not reported | 5 | 0.1% | 39,626 |
By location of breached information
| Location | Reports | Share | Individuals affected | Bar |
|---|---|---|---|---|
| Network Server | 3,698 | 46.1% | 992,622,069 | |
| 1,858 | 23.2% | 52,855,850 | ||
| Paper/Films | 1,013 | 12.6% | 7,410,388 | |
| Laptop | 515 | 6.4% | 10,367,181 | |
| Electronic Medical Record | 477 | 5.9% | 18,590,504 | |
| Other | 464 | 5.8% | 28,046,241 | |
| Desktop Computer | 381 | 4.7% | 12,819,208 | |
| Other Portable Electronic Device | 331 | 4.1% | 7,932,795 |
Business associate involvement
| Business associate present | Reports | Share | Individuals affected | Bar |
|---|---|---|---|---|
| No | 5,621 | 70.1% | 482,138,556 | |
| Yes | 2,403 | 29.9% | 612,490,095 |
Investigation status
| Portal status | Reports | Share | Individuals affected | Bar |
|---|---|---|---|---|
| Archive (closed) | 7,271 | 90.6% | 911,759,278 | |
| Under investigation | 753 | 9.4% | 182,869,373 |
By state
| State | Reports | Share | Individuals affected | Bar |
|---|---|---|---|---|
| California | 786 | 9.8% | 79,958,213 | |
| Texas | 656 | 8.2% | 49,863,944 | |
| New York | 516 | 6.4% | 42,558,825 | |
| Florida | 473 | 5.9% | 54,112,976 | |
| Illinois | 364 | 4.5% | 22,594,404 | |
| Pennsylvania | 345 | 4.3% | 21,205,627 | |
| Ohio | 278 | 3.5% | 18,927,883 | |
| Massachusetts | 245 | 3.1% | 28,784,150 | |
| Michigan | 241 | 3.0% | 16,131,814 | |
| Georgia | 230 | 2.9% | 38,859,962 | |
| North Carolina | 210 | 2.6% | 28,692,755 | |
| Indiana | 204 | 2.5% | 93,117,155 | |
| Tennessee | 200 | 2.5% | 39,597,433 | |
| Minnesota | 194 | 2.4% | 212,076,397 | |
| Washington | 187 | 2.3% | 23,291,258 | |
| New Jersey | 177 | 2.2% | 79,985,058 | |
| Maryland | 172 | 2.1% | 19,570,764 | |
| Missouri | 167 | 2.1% | 17,582,532 | |
| Arizona | 167 | 2.1% | 16,201,503 | |
| Virginia | 158 | 2.0% | 25,324,969 | |
| Connecticut | 146 | 1.8% | 11,380,761 | |
| Colorado | 142 | 1.8% | 29,384,025 | |
| Wisconsin | 126 | 1.6% | 12,717,130 | |
| Kentucky | 124 | 1.5% | 11,757,126 | |
| Oregon | 120 | 1.5% | 5,405,904 | |
| Alabama | 101 | 1.3% | 14,149,604 | |
| Iowa | 100 | 1.2% | 6,614,525 | |
| Arkansas | 94 | 1.2% | 2,597,059 | |
| South Carolina | 87 | 1.1% | 2,631,488 | |
| Oklahoma | 83 | 1.0% | 6,107,720 | |
| Kansas | 83 | 1.0% | 2,096,082 | |
| Utah | 68 | 0.8% | 7,085,448 | |
| Louisiana | 67 | 0.8% | 4,438,165 | |
| Nebraska | 60 | 0.7% | 5,403,241 | |
| New Mexico | 57 | 0.7% | 4,378,605 | |
| Mississippi | 55 | 0.7% | 2,459,630 | |
| Nevada | 55 | 0.7% | 12,507,230 | |
| West Virginia | 49 | 0.6% | 1,850,823 | |
| New Hampshire | 41 | 0.5% | 1,163,058 | |
| Rhode Island | 41 | 0.5% | 544,697 | |
| Maine | 39 | 0.5% | 3,296,092 | |
| Montana | 36 | 0.4% | 1,865,004 | |
| District of Columbia | 34 | 0.4% | 741,808 | |
| Idaho | 32 | 0.4% | 1,543,757 | |
| Delaware | 32 | 0.4% | 5,341,160 | |
| Alaska | 32 | 0.4% | 925,719 | |
| Puerto Rico | 32 | 0.4% | 1,712,827 | |
| Hawaii | 24 | 0.3% | 614,294 | |
| Not reported | 23 | 0.3% | 3,986,752 | |
| North Dakota | 21 | 0.3% | 823,546 | |
| Wyoming | 19 | 0.2% | 287,419 | |
| Vermont | 16 | 0.2% | 201,678 | |
| South Dakota | 15 | 0.2% | 178,652 |
25 largest reports
| Covered entity | State | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|---|
| Change Healthcare, Inc. | MN | Business Associate | 192,700,000 | Jul 19, 2024 | Hacking/IT Incident | Archive (closed) |
| Anthem Inc. | IN | Health Plan | 78,800,000 | Feb 13, 2015 | Hacking/IT Incident | Archive (closed) |
| Conduent Business Services LLC | NJ | Business Associate | 62,224,658 | Oct 8, 2025 | Hacking/IT Incident | Under investigation |
| DentaQuest, LLC | MA | Health Plan | 15,000,000 | Jul 16, 2026 | Hacking/IT Incident | Under investigation |
| Welltok, Inc. | CO | Business Associate | 14,782,887 | Nov 6, 2023 | Hacking/IT Incident | Archive (closed) |
| Aflac Incorporated (“Aflac”) | GA | Health Plan | 13,924,906 | Aug 8, 2025 | Hacking/IT Incident | Under investigation |
| Kaiser Foundation Health Plan, Inc. | CA | Health Plan | 13,400,000 | Apr 12, 2024 | Unauthorized Access/Disclosure | Archive (closed) |
| Optum360, LLC | MN | Business Associate | 11,500,000 | Jul 1, 2019 | Hacking/IT Incident | Archive (closed) |
| HCA Healthcare | TN | Business Associate | 11,270,000 | Jul 31, 2023 | Hacking/IT Incident | Archive (closed) |
| Premera Blue Cross | WA | Health Plan | 11,000,000 | Mar 17, 2015 | Hacking/IT Incident | Archive (closed) |
| Laboratory Corporation of America Holdings dba LabCorp | NC | Healthcare Provider | 10,251,784 | Jul 13, 2019 | Hacking/IT Incident | Archive (closed) |
| Aesto, LLC | AL | Business Associate | 9,540,683 | Jul 31, 2026 | Hacking/IT Incident | Under investigation |
| Excellus Health Plan, Inc. | NY | Health Plan | 9,358,891 | Sep 9, 2015 | Hacking/IT Incident | Archive (closed) |
| Perry Johnson & Associates, Inc. dba PJ&A | NV | Business Associate | 9,302,588 | Nov 3, 2023 | Hacking/IT Incident | Archive (closed) |
| Maximus, Inc. | VA | Business Associate | 9,179,390 | Aug 4, 2023 | Hacking/IT Incident | Archive (closed) |
| Managed Care of North America | GA | Business Associate | 8,627,242 | May 26, 2023 | Hacking/IT Incident | Archive (closed) |
| Delta Dental of California | CA | Health Plan | 7,056,189 | Sep 5, 2023 | Hacking/IT Incident | Archive (closed) |
| Episource, LLC | CA | Business Associate | 6,725,572 | Jun 6, 2025 | Hacking/IT Incident | Under investigation |
| Community Health Systems Professional Services Corporations | TN | Healthcare Provider | 6,121,158 | Aug 21, 2014 | Hacking/IT Incident | Archive (closed) |
| Lumexa Imaging | NC | Healthcare Provider | 5,830,949 | May 15, 2026 | Hacking/IT Incident | Archive (closed) |
| PharMerica Corporation | KY | Healthcare Provider | 5,815,591 | May 12, 2023 | Hacking/IT Incident | Archive (closed) |
| Yale New Haven Health System | CT | Healthcare Provider | 5,556,702 | Apr 11, 2025 | Hacking/IT Incident | Archive (closed) |
| Ascension Health | MO | Healthcare Provider | 5,466,931 | Jul 3, 2024 | Hacking/IT Incident | Archive (closed) |
| Science Applications International Corporation (SA | VA | Business Associate | 4,900,000 | Nov 4, 2011 | Loss | Archive (closed) |
| HealthEC LLC | NJ | Business Associate | 4,786,241 | Dec 21, 2023 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
How many healthcare data breaches were there in 2024?
741 breach reports were submitted to HHS OCR in 2024, affecting 290,048,244 individuals. These counts cover only HIPAA breaches affecting 500 or more individuals reported to HHS OCR, from our October 2026 export.
How many healthcare data breaches in 2023?
745 breach reports were submitted to HHS OCR in 2023, affecting 183,256,225 individuals. These counts cover only HIPAA breaches affecting 500 or more individuals reported to HHS OCR, from our October 2026 export.
What is the most common type of healthcare data breach?
Hacking/IT Incident is the most common type, listed on 4,838 of 8,024 reports (60.3%). These counts cover only HIPAA breaches affecting 500 or more individuals reported to HHS OCR, from our October 2026 export.
What is the largest healthcare data breach?
The largest single report in our data is Change Healthcare, Inc. (MN), submitted Jul 19, 2024, affecting 192,700,000 individuals. These counts cover only HIPAA breaches affecting 500 or more individuals reported to HHS OCR, from our October 2026 export.
Source: HHS OCR Breach Portal, OCR export October 2026.