Washington, September 9 — The number of Americans caught up in healthcare data breaches is climbing far faster than the number of reported incidents, according to updated federal statistics released by the HIPAA Journal this week. The figures, drawn from the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) breach portal and covering October 2009 through June 2026, show a record 772 large breaches — those affecting 500 or more individuals — were reported in 2025.
That is the highest annual total since reporting began, continuing a sharp upward trend that saw breaches double between 2018 and 2021 as cybercriminals adopted ransomware and targeted the healthcare sector. Yet the real story is in the victim counts.
Between 2022 and 2023, the number of large breaches rose about 3.8%, but the number of affected individuals jumped more than 193%. From 2023 to 2024, breaches actually declined 0.5%, while the affected population soared 58% to more than 289 million in a single year — nearly 85% of the U.S. population. The driver is the mega breach, defined as an incident affecting more than 1 million people.
The largest healthcare data breach on record occurred in 2024 at Change Healthcare, a clearinghouse, affecting an estimated 192.7 million individuals. That surpassed the previous record of 78.8 million set by Anthem Inc. in 2015.
Mega breaches continued through 2025, including incidents at business associate Conduent Business Services, affecting more than 62 million Americans (the third-largest ever), at Aflac (almost 14 million affected, the fifth-largest), and at Episource (more than 6.7 million). There is a wrinkle in this year’s numbers. For the period January 1 to April 30, 2026, 252 large breaches were reported — a 9.5% decrease compared with the same stretch in 2025.
But the HIPAA Journal cautions that OCR has been slow to publish data this year, likely because of the longest-ever government shutdown, which halted HHS operations for 43 days from October 1 to November 12, 2025. No breaches were added to the portal for March 2026 even three months after staff returned, and as of June 2026, March incidents were still being added. That lag means the apparent decline could narrow as reporting catches up.
Smaller incidents are also on the rise, though they get less attention. OCR only publishes details of breaches affecting 500 or more individuals, though all breaches must be reported.
The latest HITECH Act report to Congress for calendar year 2024 shows a 12% increase in small breaches from 2020 to 2024, with most being unauthorized access or disclosure incidents like accidental faxing or emailing. The practical upshot for patients: even as the raw number of headline-grabbing hacks levels off, the concentration of records in clearinghouses and business associates means a single failure can expose a swath of the country at once. Watch for whether the 2026 reporting backlog, once cleared, confirms that trend is still accelerating.
