Hackers demand an average of $18.2 million after a healthcare ransomware attack, nearly six times more than the next-closest industry, according to a BakerHostetler analysis.
Here are seven more things to know from the annual Data Security Incident Response Report, which analyzed over 1,250 cyber incidents the law firm handled in 2025 and was released in late March:
1. While the initial ransom demand in healthcare averaged $18.2 million, firms paid an average of $1.2 million. By comparison, in the energy and technology category, those numbers were $3.2 million and $1.7 million, respectively.
2. The single largest demand in healthcare was $98 million and the largest ransom paid was $5 million, both the highest of any industry.
3. Healthcare (which includes pharma and biotech) represented the majority of data breaches, or 27%, followed by finance and insurance (18%) and business and professional services (15%).
4. An average of 357,020 individuals per healthcare hack were notified that their data was breached, though the largest represented 3.4 million people.
5. It took healthcare organizations an average of 12.7 days to restore data after a ransomware attack, with forensic investigations costing $39,934 on average.
6. Thirty-one of the 68 incidents that resulted in one or more lawsuits being filed involved healthcare.
7. More than a third of the healthcare hackers originated with third-party vendors (compared to 25% across industries).
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.