Bridewell research based on HHS breach data highlights the growing impact of healthcare cybersecurity incidents across the United States.
New research from Bridewell reveals the widespread impact healthcare data breaches continue to have on residents across the United States, with millions of individuals affected and thousands of healthcare organizations implicated since 2023.
The research analyzed active investigations and archived breach records from the U.S. Department of Health and Human Services’ Breach Portal covering the period from 2023 through 2026. According to the findings, more than 2,200 healthcare centers have been affected by data breaches during that timeframe.
In 2026 alone, 52 healthcare centers have already been under investigation for data breaches, affecting more than 5.5 million people.
California recorded the highest number of healthcare data breaches nationwide with 231 incidents impacting more than 52 million individuals. One of the most notable incidents occurred in December 2025 when Blue Shield disclosed that sensitive medical information had been shared with Google advertising platforms because of a misconfigured Google Analytics setup. The breach exposed records belonging to 4.7 million people.
California lawmakers responded by tightening breach notification regulations through Senate Bill 446, which was signed into law in late 2025. The legislation requires organizations to notify affected residents within 30 days and provide plain-language explanations detailing what information was exposed and what actions are being taken following a breach.
Texas ranked second nationally with 172 healthcare data breaches affecting 20 million individuals. In February 2026, the Texas Attorney General announced an investigation into Conduent Business Services following a data breach affecting more than 192 million people.
New York ranked third for breach volume with 159 incidents and 13 million individuals affected. Among the incidents cited in the report was a February 2026 breach involving the New York City Health and Hospitals Corporation. According to the disclosure, an unauthorized actor accessed the organization’s network undetected for two months. Exposed information reportedly included medical records, Social Security numbers, biometric data including fingerprints and palm prints along with financial account details.
While California, Texas and New York experienced the highest breach volumes, the states with the greatest number of impacted individuals differed significantly.
Minnesota recorded only 48 breaches since 2023 but those incidents affected more than 197 million individuals. On average, roughly four million individuals were impacted per breach, illustrating how a relatively small number of incidents can expose massive amounts of patient data.
California ranked second by number of individuals affected with more than 52 million people impacted across 231 breaches, averaging approximately 787,000 individuals per breach.
Georgia ranked third with 64 breaches affecting an estimated 30 million individuals, averaging around 471,000 individuals per incident.
The research also found that although the number of healthcare centers under investigation increased sharply in 2025, the number of people impacted declined substantially between 2024 and 2025. An estimated 289 million people had data stolen in 2024 compared to 63 million in 2025.
Kelechi Onyedebelu, Director Security Solutions Presales at Bridewell US, said the reduction in affected individuals was encouraging but emphasized that healthcare data breaches remain a major issue.
“It’s promising to see that the number of people impacted by healthcare data breaches declined in 2025, however, it’s clear that this is still a widespread issue,” Onyedebelu said.
He added that updated HIPAA rules requiring network segmentation may have helped reduce the scale of breaches by limiting attackers’ access once inside a system. Onyedebelu also pointed to faster breach detection and containment as a factor in reducing victim counts.
At the same time, he noted that thousands of healthcare centers continue to be impacted by breaches and warned that threat actors are targeting the healthcare sector “at an unprecedented scale.”