NASHVILLE, September 20 — The cyberattack on Change Healthcare exposed the records of roughly 192.7 million people, a figure that still frames how the health industry talks about digital risk as it absorbs the fallout from one of the largest breaches ever recorded in American medicine. The numbers behind that breach are not abstract. IBM’s Cost of a Data Breach Report put the average healthcare breach at $7.42 million in 2025 — the highest of any industry for the fourteenth year running.
Healthcare breaches cost roughly $400 per exposed record, about three times the cross-industry average.
When Records Lock, Care Slows
A cyberattack on a hospital is a clinical event, not only an IT one. When ransomware locks electronic health records, clinicians lose access to allergies, medication histories, and test results. Care slows to a crawl.
Ponemon Institute research found that nearly one in four healthcare organizations saw higher patient mortality after a ransomware attack. Such attacks forced procedure delays at 64 percent of victims and ambulance diversions or transfers at 65 percent.
Patients stayed longer at 59 percent of hospitals hit, and 36 percent linked procedure complications to the attack. Ascension’s 2024 ransomware attack made the pattern concrete. The health system diverted ambulances, paused elective procedures, and reverted to paper records across dozens of hospitals, later citing the incident in a $1.1 billion net loss.
Why the Data Pays
Attackers target healthcare because the data pays. A medical record sells for far more than a credit card number, since it bundles identity, insurance, and clinical details that cannot be cancelled or reissued. Financial gain drives around 90 percent of them.
Stolen records feed insurance fraud, prescription fraud, and identity theft for years after the breach itself. Disruption supplies a second motive.
A hospital cannot pause operations, so attackers know the pressure to restore systems is intense. That is why healthcare is the most ransomed sector and faces among the steepest demands. The exposure widens as care goes digital.
Electronic health records, patient portals, telehealth, and cloud systems all enlarge the attack surface. In aggregate, more than 250 million Americans had health data exposed in 2024, and 2025 set a record with more than 770 large breaches reported to regulators.
What Defenses Look Like
HIPAA remains the governing rule for health data. Defenses span monitoring of surface, deep, and dark web threats, brand and infrastructure monitoring, third-party risk monitoring, and AI-driven cyber risk quantification. For the families whose records sat inside the Change Healthcare breach, the practical question is what comes next.
Watch for regulatory action on third-party risk and for whether the breach totals keep climbing as the industry moves more care online. Consult your doctor for medical advice.
