Healthcare data breaches cost an average of $6.64 million in 2026.
According to IBM’s “Cost of a Data Breach Report 2026,” conducted by Ponemon Institute, that figure marks healthcare’s 13th consecutive year as the costliest industry for data breaches, though the average is down 10.5% from $7.42 million in 2025. Financial services ranked second at $6.29 million.
Attackers continue to target healthcare’s patient personally identifiable information, which can be used for identity theft, insurance fraud and other financial crimes, according to the report.
The findings come as the global average cost of a data breach across all industries climbed 12% to $4.99 million, driven largely by detection, escalation and lost business costs. The mean time to identify and contain a breach across all industries rose to 247 days.
Ponemon Institute interviewed 3,558 security and C-suite leaders across 602 organizations that experienced data breaches between March 2025 and February 2026, spanning 17 industries and 16 countries and regions.
The report also found that AI-driven attacks rose 56% year over year and added an average of $1 million to malicious breach costs, a trend that could compound pressure on healthcare organizations as attackers increasingly target AI models and applications alongside traditional systems.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.