Why healthcare keeps paying the highest breach costs

Healthcare has reported the highest average data-breach cost of any industry for well over a decade, and cyberattacks on the sector have risen sharply since 2020. IBM’s Cost of a Data Breach research has put healthcare at the top of the industry table for fourteen consecutive years, with an average cost per breach roughly double the global average. The reasons are not mysterious. Patient data is uniquely sensitive, heavily regulated, and overwhelmingly unstructured — imaging, records, documents, and exports spread across file shares and aging infrastructure.

What is worth examining is why the number refuses to come down, year after year, despite healthcare organizations spending more on security than ever. The answer is structural, and it lives closer to the data layer than most security budgets do.

When a payment card is stolen, the bank cancels it and the damage window closes. A medical history has no cancel button. Diagnoses, medications, imaging, genetic information, and identity details stay valid for the patient’s lifetime, which is why complete health records command a persistent premium over card data in criminal markets and why the liability from disclosure does not fade. Every year the same records sit exposed on the same shares, the same tail risk compounds.

In most industries, ransomware downtime is measured in lost revenue. In a hospital it is measured in diverted ambulances, postponed procedures, and clinicians working from paper. That difference is precisely the leverage extortion crews price into their demands: an organization that cannot tolerate the outage negotiates differently than one that can. The pressure to restore quickly also inflates every other cost, from emergency response retainers to overtime, and it is why recovery speed, not just recovery certainty, belongs in healthcare risk planning.

HIPAA’s Breach Notification Rule requires notifying affected individuals, and for incidents affecting 500 or more people, notifying HHS and often the media, on a clock. Breaches are published on the HHS Office for Civil Rights breach portal, litigation frequently follows, and settlements, credit monitoring, and OCR enforcement stack on top of the operational damage. The disclosure question that drives most of this cost is not “what was encrypted” but “what was accessed,” which is an audit question most file infrastructure cannot answer with precision. When an organization cannot prove which records were touched, it must assume, and notify, the maximum.

A hospital’s most sensitive data does not sit neatly in the EHR database. It accumulates as files: PACS and DICOM imaging archives, EHR exports and interface drops, scanned documents, research datasets, departmental shares that have grown for twenty years. Much of the surrounding infrastructure (imaging modalities, lab instruments, clinical workstations running vendor-locked builds) cannot run endpoint agents at all, and the NAS platforms holding the files never could. The result is that the sector’s largest concentration of protected health information carries the least behavioral monitoring in the environment.

Care runs on data exchange: business associates, billing services, imaging partners, payers, research collaborators. Every connection is a credential, and a phished or purchased credential entering through any of them looks legitimate to perimeter and identity controls. The attacks that generate healthcare’s worst years increasingly begin as valid logins followed by quiet, high-volume reads of patient data, activity that produces no malware signature and no alert from tools watching the network edge.

Put the five reasons together and they converge on one place. When an attack hits a hospital, the operational impact comes from losing access to unstructured clinical and administrative data, and the disclosure exposure comes from it being copied. Both happen at the storage layer. Compliance, meanwhile, demands something most file infrastructure cannot produce on its own: a complete, audit-ready record of who accessed which files, when, and from where.

This is also where the agent problem resolves. Storage-layer defense requires nothing on the modality, the workstation, or the interface engine: the NAS itself evaluates every read and write, for every client, with full user and session context. The systems that cannot be instrumented are protected by the one system that sees all of their file activity anyway.

Two capabilities move the numbers. First, active defense on production data, so a ransomware or exfiltration attempt is detected and stopped before it spreads across the environment. Behavioral detection tuned per user and role catches the encryption run in its first seconds and, just as important for healthcare, catches the abnormal read patterns of record snooping and bulk theft that change nothing and therefore evade every backup-based control. Inline response terminates the session while the blast radius is still a handful of files.

Second, audit-ready visibility into file activity, so compliance reporting is a query rather than a project, and incident response starts with evidence rather than guesswork. A per-operation record of exactly which files an account touched converts the worst-case disclosure assumption into a scoped, defensible notification, which is frequently the difference between a contained incident and a headline. Surgical recovery closes the loop: restoring only the files an attack touched brings systems back in minutes, which in this sector is a patient-safety outcome as much as a financial one.