Takeaways from healthcare cyberattacks in 2025

There were fewer victims of attacks aimed at healthcare organizations, but more than 40 million were affected and hospitals remain targets.

There’s some good news, relatively speaking, when it comes to cybersecurity in the healthcare industry.

Through Dec. 12, more than 42 million people were affected by cyberattacks aimed at health providers. That’s a lot of people to be sure. But in 2024, more than 270 million people, 3 in 4 Americans, were affected, most of them by the Change Healthcare cyberattack.

Still, cybersecurity experts with the American Hospital Association say health systems can’t let their guards down.

Here are some threats hospitals must recognize.

First, let’s talk AI. Attackers are using AI to create more convincing phishing emails. Forget the clumsy emails with four typos in the first sentence. Bad actors are using AI for more polished messages aimed at catching people with their guards down.

Ransomware groups are also using AI tools to hack into health systems , and they may be adopting AI more quickly, says Baxter Lee, president of Clearwater, a cybersecurity company that works with hospitals.

“I think attackers are probably using AI faster than we're using it to defend against it,” Lee told Chief Healthcare Executive® in an interview at the HLTH conference.

Health systems continue to be victimized by attacks aimed at software problems that haven’t been addressed. It’s a perennial problem, and it exposes systems to attack. Importantly, many of these problems come from software employed outside health systems.

And that leads to another big risk for cyberattacks: third parties and business associates. Many of the attacks disrupting hospitals and health systems are targeting the vendors that hospitals use everyday. The Change Healthcare attack last year was the most chilling example of the risks from a vendor. Nearly every hospital in America was affected, because the target was a business partner that virtually everyone uses.

Hospitals are making solid progress in bolstering their defenses against cyberattacks. But the risks aren’t going away anytime soon.

Healthcare data breaches remain the most expensive of any industry. The average cost of a data breach in a healthcare organization was $9.7 million in 2024 , according to an analysis by IBM.

We talked with John Riggi, national adviser for cybersecurity and risk of the American Hospital Association, and Scott Gee, deputy national advisor for cybersecurity and risk, cyberattacks affecting hospitals in 2025. For a deeper dive on attacks, the risks to hospitals and what health systems can do, check out our report published last week.

Tiffany A. Traina, MD, FASCO; Demetria Smith-Graziani, MD, MPH

Mark Agulnik, MD; Shaina A. Rozell, MD, MPH

Mark Agulnik, MD; Mrinal M. Gounder, MD; Jacqueline M. Kraveka, DO; Lee M. Zuckerman, MD

Mark Agulnik, MD; Mrinal M. Gounder, MD; Jacqueline M. Kraveka, DO; Daniel Lefler, MD; Shaina A. Rozell, MD, MPH; Lee M. Zuckerman, MD

Mark Agulnik, MD; Daniel Lefler, MD

Naval G. Daver, MD; Jessica Altman, MD; Amir T. Fathi, MD; Gail J. Roboz, MD; Joshua Zeidner, MD

Estelamari Rodriguez, MD, MPH; Millie Das, MD; Ruham Nasany, MD

Zev A. Wainberg, MD; Manish A. Shah, MD, FASCO; Syma Iqbal, MD

Anne Chiang, MD, PhD; J. Douglas Miles, MD, PhD, FAAN; Suma Satti, MD

Jennifer R. Brown, MD, PhD; Alexey V. Danilov, MD, PhD; Matthew S. Davids, MD, MMSc

Stephen V. Liu, MD; Michelle Afkhami, MD; Ignacio I. Wistuba, MD; Helena Yu, MD

Rahul Gosain, MD, MBA; Rohit Gosain, MD; Ghassan Abou-Alfa, MD, MBA

Hope S. Rugo, MD, FASCO; Neil M. Iyengar, MD; Komal Jhaveri, MD, FACP

Rebecca Shatsky, MD; Kelly McCann, MD, PhD; Michelle L. Taylor, ANP-BC

Rahul Gosain, MD, MBA; Rohit Gosain, MD; Shubham Pant, MD, MBBS

Rahul Gosain, MD, MBA; Rohit Gosain, MD; Rachna T. Shroff, MD, MS, FASCO

Yana G. Najjar, MD; Douglas B. Johnson, MD, MSCI; Rahul A. Sheth, MD, FSIR

Cindy Neunert, MD, MSCS; Hanny Al-Samkari, MD; Joseph Shatzel, MD, MCR

John H. Strickler, MD; Stacey A. Cohen, MD; Aparna Parikh, MD; Kanwal P.S. Raghav, MBBS, MD

Eileen M. O’Reilly, MD; E. Gabriela Chiorean, MD, FASCO; Michael J. Pishvaian, MD, PhD; Brian Wolpin, MD, MPH

Vinay K. Puduvalli, MD; Manmeet Ahluwalia, MD, MBA; Stephen J. Bagley, MD, MSCE; Angela Waanders, MD, MPH, MS

C. Ola Landgren, MD, PhD; Mohamad Mohty, MD, PhD; Surbhi Sidana, MD

Jonathan W. Goldman, MD; Percy Lee, MD, FASTRO; Erminia Massarelli, MD, PhD, MS; Misty D. Shields, MD, PhD

C. Ola Landgren, MD, PhD; Mohamad Mohty, MD, PhD; Surbhi Sidana, MD

Rami Komrokji, MD; Gabriela Hobbs, MD; John Mascarenhas, MD; Naveen Pemmaraju, MD

Balazs Halmos, MD, MS; Enriqueta Felip, MD, PhD; Julia Rotow, MD

Rebecca Heist, MD, MPH; Alex A. Adjei, MD, PhD, FACP; Sandip Patel, MD, FASCO; Jeremy Segal, MD, PhD

Gail J. Roboz, MD; Hagop Kantarjian, MD; Catherine Lai, MD, MPH; Amer Zeidan, MBBS, MHS

William J. Gradishar, MD, FASCO, FACP; Laura Huppert, MD; Yuan Yuan, MD, PhD

Jason Hafron, MD; Aaron D. Berger, MD; Arpeet Shah, MD