U.S. Healthcare Sector Faces Persistent Cyberattack Surge, Exposing Millions of Records Since 2023, over 2,200 U.S. healthcare facilities have reported data breaches, highlighting critical vulnerabilities in patient record systems. While the number of affected individuals declined in 2025 dropping from 289 million in 2024 to 63 million attack volumes remain alarmingly high, according to research by Bridewell. California has been the hardest-hit state, with 231 breaches exposing data on more than 52 million people. In response, the state enacted Senate Bill 446, mandating organizations to notify residents within 30 days using clear language about exposed data and remediation steps. Texas (172 incidents) and New York (159 breaches) follow as the next most impacted states. A February 2025 intrusion at New York City Health and Hospitals Corporation resulted in the theft of Social Security numbers, medical records, and biometric data after attackers evaded detection for two months. Kelechi Onyedebelu, Bridewell’s director of security solutions presales, noted that while healthcare organizations are improving at limiting breach damage, they still struggle with preventing intrusions. The decline in affected individuals is partly attributed to faster detection and HIPAA-mandated network segmentation, which restricts attackers from moving laterally across systems. Despite progress, 26% of healthcare organizations report low cybersecurity maturity. Major incidents persist, including a 2025 ransomware attack on Kettering Health, disrupting 14 medical centers by crippling phone lines and electronic health records. Minnesota and Georgia also face severe per-breach impacts, with Minnesota averaging 4.1 million affected individuals per incident across 48 breaches since 2023.