November 2025 Healthcare Data Breach Report: A Rare Decline Amid Government Shutdown Delays November 2025 marked a notable drop in reported healthcare data breaches, with just 32 incidents affecting 500 or more individuals submitted to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). This represents a 54% reduction from November 2024 and a 56% decline from November 2023, the lowest figures since 2018. However, the decrease coincides with a U.S. government shutdown from October 1 to November 12, 2025, which halted breach reporting and created a backlog that may still be clearing. Despite fewer breaches, the number of affected individuals also fell sharply. November saw 1.4 million patients impacted the lowest monthly total since January 2023 and an 87.2% drop from October. For the year to date, 686 large breaches have exposed the data of 55.7 million individuals. ### Largest Breaches of November 2025 The month’s most significant incidents included: - VITAS Hospice Services (Florida): A vendor account compromise led to unauthorized access affecting 320,000 patients. - Fieldtex Products: A hacking incident exposed 238,615 records, with additional breaches reported in December. - Delta Dental of Virginia: An email breach initially reported as affecting 145,918 individuals was later revised to 126,953. ### Breach Causes & Trends - Hacking/IT incidents dominated, accounting for 78% of breaches and 99.1% of affected individuals (1.4 million). - Unauthorized access/disclosure made up 15.6% of breaches but only 0.5% of impacted individuals. - Ransomware remains a critical threat, with groups like Qilin, INC Ransom, and SafePay driving a 58% year-over-year increase in attacks. Some, like Pear, now focus on data theft and extortion without encryption. - Email compromises were involved in 19% of hacking incidents, often serving as an entry point for broader attacks. ### Where Breaches Occurred - Healthcare providers suffered the most, with 22 breaches affecting 867,100 individuals. - Business associates reported 7 breaches, impacting 419,716 individuals. - Virginia had the most breaches (4), while Florida saw the highest number of affected individuals (322,859). ### HIPAA Enforcement The government shutdown disrupted HHS operations, delaying enforcement announcements. Despite this, 2025 remains one of the busiest years for HIPAA penalties, with OCR closing the year with the second-highest annual total of settlements and fines. No new enforcement actions were announced in November. While the decline in breaches is encouraging, experts warn that unreported incidents from the shutdown period and ongoing ransomware threats could reverse the trend in coming months. The data reflects reports submitted to OCR as of January 20, 2026.