Ransomware attacks and unverified ransomware claims targeting U.S. healthcare organizations increased 64% in the third quarter of 2026 from the second quarter, an Oct. 15 report from cybersecurity research company Comparitech found.
Here are 10 things to know from the report:
- The U.S. accounted for 185 of the 306 healthcare ransomware incidents and claims tracked worldwide between July and September. Of those U.S. incidents, 26 were confirmed, including 23 involving healthcare providers.
- Globally, healthcare ransomware incidents and claims increased 40% from the second quarter, when Comparitech tracked 219, and more than doubled from 151 during the same period in 2025.
- The increase exceeded ransomware trends across all industries. Comparitech’s broader research found a 29% quarter-over-quarter increase and a 61% year-over-year increase across sectors.
- Of the 306 worldwide incidents and claims, 53 were confirmed attacks and 253 remained unverified. Comparitech considers an incident confirmed when an organization publicly acknowledges ransomware involvement or reports a cyberattack consistent with a ransomware group’s claim. Claims that have not been acknowledged by the targeted organization remain unconfirmed. Comparitech said its figures may change as additional attacks are confirmed or attributed to earlier reporting periods.
- Hospitals, clinics and other direct-care providers accounted for 192 of the global healthcare incidents and claims. Of those, 40 were confirmed attacks and 152 were unconfirmed claims. Comparitech identified 618,149 records known to have been compromised in the confirmed provider attacks.
- The remaining 114 incidents and claims involved businesses operating in healthcare, including medical manufacturers, billing companies and technology providers. Thirteen were confirmed attacks, while 101 remained unverified.
- Healthcare technology companies experienced the largest quarter-over-quarter increase among the healthcare business categories highlighted in the report. Comparitech identified 22 incidents and claims targeting those companies, up 175% from eight in the previous quarter. Medical manufacturers accounted for another 51 incidents and claims, a 28% increase from the second quarter.
- Saber Healthcare Group had the largest reported ransomware-related breach, affecting 427,084 people. The organization confirmed in July that a cyberattack had encrypted some files and disrupted services. In September, it began notifying individuals of a breach involving medical information, health insurance details and Social Security numbers. Other large breaches identified in the report involved Park Place Behavioral Healthcare, affecting 71,702 people; Hawaii Family Dental, affecting 45,853; WindRose Health Network, affecting 33,158; and Vernon & Waldrep OB-Gyn Associates, affecting 17,435.
- The median reported ransom demand was $300,000 for healthcare providers and $150,000 for healthcare businesses. No ransom payments were officially confirmed during the reporting period.
- The Gentlemen made the most claims against healthcare providers, with 18, followed by INC with 14. Qilin led claims against healthcare businesses with 15. Chaos had the most confirmed attacks in each category.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
