Healthcare is the one sector where a cyber attack can be measured in postponed operations and, in at least one confirmed UK case, a death. It is also the sector that reports more personal data breaches to the ICO than any other, most of them nothing to do with hackers. Those two facts sit side by side in the data, and both matter if you are trying to understand the risk.

In this article we have pulled together the latest healthcare cyber attack statistics from the sources that hold the data: NHS England and the Department of Health and Social Care, the ICO’s incident dataset, the government’s Cyber Security Breaches Survey, the NCSC, Companies House filings, and the primary research from Sophos, IBM, Verizon, ENISA, Check Point and the Ponemon Institute. UK figures come first in every section. Where a figure is American or global we say so in the line, because most of the healthcare statistics that circulate online are US numbers from the HHS breach portal and get quoted here as if they described the NHS.

The page is organised around the questions people ask: how many attacks hit the NHS and UK healthcare, what happened at Synnovis and what it cost, how many health data breaches the ICO sees, what ransomware looks like in healthcare, what an attack costs, how the US compares, and what the regulators and the Cyber Security and Resilience Bill are changing.

Key healthcare cyber attack statistics for 2026 at a glance

• UK health organisations reported 2,471 personal data breaches to the ICO in 2025, more than any other sector and 18% of all reports, but only 182 of them (7%) were cyber incidents (our count of the ICO data security incident trends dataset, 2025).
• The June 2024 ransomware attack on NHS pathology supplier Synnovis postponed 10,152 acute outpatient appointments and 1,710 elective procedures across two London trusts (NHS England, 2024), cost Synnovis an estimated £32.7m in 2024 against a 2023 profit of £4.3m (Synnovis accounts, January 2025) and directly contributed to at least one patient death (NCSC Annual Review 2025).
• Ransomware reports from the UK health sector to the ICO fell to 22 in 2025 from 78 in 2024 and 106 in 2022, the year of the Advanced attack (our count of the ICO dataset).
• Phishing accounted for 98 of the 182 health sector cyber incidents reported to the ICO in 2025, or 54% (our count of the ICO dataset).
• 33% of UK health or social care businesses identified a cyber breach or attack in the last 12 months, against 43% of businesses overall; 20% experienced a cyber crime (Cyber Security Breaches Survey 2025/26, DSIT, small sector sample).
• The ICO fined Advanced Computer Software Group £3,076,320 in March 2025 for the 2022 ransomware attack that disrupted NHS 111 and exposed the data of 79,404 people (ICO, 27 March 2025).
• 36% of healthcare ransomware victims paid the ransom in 2025, the median demand fell 91% to $342,000, and the average recovery cost excluding any ransom was $1.02m (Sophos State of Ransomware in Healthcare 2025, 17 countries).
• US healthcare organisations reported 802 breaches of 500 or more records to the HHS Office for Civil Rights in 2025, affecting 140.5 million people (our count of the OCR breach portal, checked 11 October 2026).
• Healthcare was the costliest industry for a data breach for the thirteenth year running, at $6.64m per breach against a global average of $4.99m (IBM Cost of a Data Breach Report 2026, global).
• Healthcare organisations faced an average of 2,309 attempted attacks per organisation per week in early 2025, up 39% year on year (Check Point Research, April 2025, global).

1. How many cyber attacks hit the NHS and UK healthcare?

There is no single published count of cyber attacks on the NHS. What exists is a set of partial measures: the ICO’s breach reports, the government’s survey of businesses, the NCSC’s incident handling figures and the NIS incident records that DHSC holds. Each measures something different, so we give them separately rather than adding them up.

• 182 cyber incidents were reported to the ICO by UK health organisations in 2025, down from 229 in 2024, 139 in 2023 and 190 in 2022. The third quarter of 2025 was the busiest with 57 (our count of the ICO dataset).
• Health accounted for 5.8% of the 3,153 cyber incidents reported to the ICO across all sectors in 2025, well behind retail and manufacture (805) and finance (400) (our count of the ICO dataset).
• Social care organisations reported a further 479 incidents in 2025, 45 of them cyber, up from 398 and 59 in 2024 (our count of the ICO dataset).
• 33% of UK businesses in health or social care identified a cyber breach or attack in the last 12 months, one of the lowest rates of any sector and ten points below the 43% average. 20% experienced a cyber crime, in line with the 19% average, and 38% have a board member responsible for cyber security against 31% overall (CSBS 2025/26; base of 101 health or social care businesses, so treat the sector lines as indicative).
• The NCSC handled 429 incidents between September 2024 and August 2025, 204 of them nationally significant, more than double the 89 of the previous year. It says it responded to several attacks in the health sector in August 2024, including Synnovis, and has since piloted Active Cyber Defence 2.0 tools with UK health organisations (NCSC Annual Review 2025).
• Under the NIS Regulations, DHSC recorded two NHS cyber incidents in 2024 in the category of potential clinical harm to more than 50 patients, and none in the excess fatalities or excess casualties categories. The data was released under FOI to Recorded Future News (The Record, May 2025; see the author notes).

The low CSBS rate for health needs a comment. The survey counts businesses, and in health that means a lot of small private practices, dental surgeries and care providers; NHS trusts and the suppliers behind the headline incidents are a small fraction of the sample. The ICO count is the better guide to what reaches a regulator, and the Synnovis numbers below are the better guide to what one incident does.

Suggested Read: Cyber Security Statistics

2. NHS cyber incidents and patient safety

The Synnovis attack in numbers

Synnovis is the pathology joint venture that runs blood testing for Guy’s and St Thomas’ and King’s College Hospital NHS Foundation Trusts and for GP practices across south east London. The Qilin ransomware group hit it on Monday 3 June 2024. It remains the most consequential cyber attack on the NHS since WannaCry, and the first in the UK with a confirmed link to a patient death.

• King’s College Hospital recorded 170 cases of patient harm linked to the attack, two of them severe, out of nearly 600 patient safety incidents logged (figures reported June 2025, Infosecurity Magazine).
• Lewisham and Greenwich NHS Trust later reported more than 11,000 cancelled appointments of its own (The Record, April 2026).
• Synnovis has never confirmed how many patients’ data was published. The figure of around 900,000 to one million comes from third-party analysis of the leaked files and is an estimate (The Register, November 2025).

Other NHS incidents, 2024 to 2026

• NHS Dumfries and Galloway, February 2024. INC Ransom stole data and published a sample in March after the board refused to pay. In June the board wrote to just under 150,000 people in the region advising them to assume some of their data had been copied and published (The Record, June 2024; NHS Dumfries and Galloway).
• Wirral University Teaching Hospital, November 2024. The trust declared a major incident for cyber security reasons, cancelled outpatient appointments and asked patients to stay away unless it was a genuine emergency while staff worked on paper (The Record, November 2024).
• DXS International, December 2025. The GP clinical decision support supplier, which says it supports around 10% of NHS referrals in England, disclosed a security incident on its office servers to the London Stock Exchange; NHS England said it was not aware of any impact on patient services (IT Pro, December 2025).
• Stryker, March 2026. A destructive attack on the medical device manufacturer, claimed by the Iran-linked group Handala, disrupted ordering, manufacturing and shipping. NHS England issued a national supply disruption notice on 18 March, placed defibrillator and oral swab lines under demand management and cancelled orders placed between 11 and 16 March; it reported no onward threat to NHS systems (NHS England, March 2026; Digital Health, March 2026).

For the baseline, WannaCry in May 2017 disrupted a third of hospital trusts and around 8% of GP practices, cancelled over 19,000 appointments and cost the NHS an estimated £92m, of which £19m was lost output and £73m IT recovery (DHSC, October 2018). It is still the only official NHS-wide cost estimate for a single attack, which is why it keeps being quoted.

Suggested Read: Cyber Security Incident Response Plan

3. UK health data breaches: what the ICO sees

The ICO publishes every personal data breach reported to it, by sector, quarter, incident type and number of people affected. We counted the unique incident references ourselves. “Health” in the ICO dataset covers the NHS and private providers; social care is a separate sector.

Source: our count of the ICO data security incident trends dataset, Q1 2019 to Q4 2025.

• Health was the largest reporting sector in 2025 with 2,471 incidents, ahead of education and childcare (1,830) and retail and manufacture (1,497) (our count).
• 2,289 of those 2,471, or 93%, were not cyber attacks. The leading non-cyber causes were unauthorised access (408), data emailed to the wrong recipient (405), data posted or faxed to the wrong recipient (209), loss or theft of paperwork (147) and failure to redact (145) (our count).
• Of the 182 health cyber incidents, phishing was the cause in 98, “other cyber incident” in 47, ransomware in 22, malware in 7, unauthorised access in 7 and brute force in 1 (our count).
• Most health cyber incidents are small: 57 affected between 100 and 1,000 people, 37 affected 10 to 99, 27 affected 1,000 to 10,000 and only one affected 100,000 or more (our count).
• 23 of the 182 health cyber incidents (13%) reached the ICO more than a week after discovery, against the 72-hour UK GDPR deadline (our count).
• The one fine: Advanced Computer Software Group was fined £3,076,320 on 27 March 2025 for the August 2022 ransomware attack on its health and care subsidiary. The attackers got in through a customer account without multi-factor authentication, took the personal data of 79,404 people including details of how to enter the homes of 890 people receiving care, and disrupted NHS 111. The provisional fine of £6.09m was reduced after Advanced engaged with the NCSC, NCA and NHS, and the company settled without appeal (ICO, March 2025).
• The ICO’s investigation into Synnovis was still open in April 2026 (The Record, April 2026).

The 2022 and 2024 ransomware spikes line up with the Advanced attack and Synnovis: one supplier incident produces dozens of breach reports from the NHS organisations that depended on it. That is the pattern to watch in the 2026 data, not the headline total.

Suggested Read: Data Protection in Healthcare and Social Care

4. Ransomware in healthcare

Ransomware is a small share of what health organisations report to the ICO and almost the whole story of what disrupts patient care. The UK-wide ransomware figures live on our malware and cyber security statistics pages; the lines below are the ones specific to healthcare.

• 22 ransomware incidents were reported to the ICO by UK health organisations in 2025, under 1% of health breach reports but the category behind the Synnovis, Advanced and Dumfries and Galloway disruption (our count of the ICO dataset).
• 36% of healthcare ransomware victims paid the ransom in 2025, down from 61% in 2022 and among the lowest rates of any sector surveyed (Sophos State of Ransomware in Healthcare 2025, 292 healthcare respondents in 17 countries, surveyed January to March 2025).
• The median ransom demand against healthcare providers fell 91% to $342,000, from $4m in 2024, and the median payment fell to $150,000 from $1.47m, the lowest of any sector (Sophos, 2025).
• 34% of healthcare ransomware attacks resulted in data being encrypted in 2025, down from 74% in 2024, and 97% of those encrypted recovered their data (Sophos, 2025).
• Exploited vulnerabilities were the most common technical root cause at 33%, followed by malicious email at 22% and compromised credentials at 18%. Lack of people or capacity was the most common operational factor, named by 42% of victims (Sophos, 2025).
• 58% of healthcare providers recovered within a week in 2025, up from 21% in 2024 (Sophos, 2025).
• In the EU, health accounted for 4.2% of cybercrime incidents in the year to June 2025, and health was one of the five NIS2 sectors most targeted by state-aligned groups (ENISA Threat Landscape 2025).

The Sophos numbers describe mid-sized providers worldwide, and the UK pattern is slightly different: the attacker does not need to encrypt a hospital, it needs to encrypt the supplier the hospital cannot work without. Synnovis, Advanced and the NHS 111 outage of 2022 were all supplier incidents.

Suggested Read: Malware Statistics

5. What a healthcare cyber attack costs

• Synnovis: £32.7m of direct losses in 2024 for a company that made £4.3m profit the year before (Synnovis accounts, January 2025).
• WannaCry: £92m across the NHS, £19m of it lost patient care and £73m IT recovery. DHSC calls this an approximate estimate because no cost data was collected during the incident (DHSC, 2018).
• Globally, healthcare breaches cost an average of $6.64m in 2026, down from $7.42m in 2025, the thirteenth consecutive year healthcare has been the most expensive industry; the all-industry average was a record $4.99m (IBM Cost of a Data Breach Report 2026). The UK average across all sectors was £3.13m, down from £3.29m (IBM UK release, July 2026).
• The average cost of the most significant cyber attack on a US healthcare organisation was $3.9m in 2025, down from $4.7m, and the average ransom paid was $1.2m (Proofpoint and Ponemon Institute, October 2025, 677 US respondents).
• The average recovery cost from a healthcare ransomware attack, excluding any ransom, was $1.02m in 2025, down 60% from $2.57m (Sophos, 2025, global).

Suggested Read: Cyber Insurance Statistics

6. US and global healthcare breach statistics

Most of the big healthcare numbers online come from the United States, where every breach of 500 or more records must be reported to the HHS Office for Civil Rights and is published on its breach portal. They are useful as a comparison and useless as a description of the UK, so they get their own section.

• 802 breaches of 500 or more records were reported to OCR in 2025, affecting 140,498,581 people. 648 of them (81%) were hacking or IT incidents (our count of the OCR breach portal, archive and open cases combined, checked 11 October 2026).
• The largest 2025 breaches were Conduent Business Services (62.2 million people), Aflac (13.9 million) and Episource (6.7 million) (OCR breach portal).
• 2024 remains the record year for people affected: 741 breaches and 290 million people, driven by the Change Healthcare ransomware attack, which the portal records at 192.7 million individuals (OCR breach portal; the earlier public figure was 190 million).
• 566 breaches affecting 76.7 million people had been reported for 2026 by 21 September 2026 (our count of the OCR portal).
• Verizon analysed 1,492 healthcare incidents with 1,438 confirmed data disclosures for its 2026 DBIR; external actors were behind 81% of healthcare breaches and third parties were involved in about 32% (Verizon DBIR 2026 healthcare snapshot; see the author notes).
• 93% of US healthcare organisations suffered at least one cyber attack in the past year, an average of 43 each; 72% said attacks disrupted patient care, and 29% of those reported increased mortality as a result (Proofpoint and Ponemon, October 2025).
• Supply chain attacks hit 44% of US healthcare organisations in 2025, down from 68%, but 87% of those affected reported disruption to patient care (Proofpoint and Ponemon, 2025).
• Healthcare organisations faced 2,309 attempted attacks per organisation per week in early 2025, a 39% rise on the same period in 2024, with APAC the most attacked region at 3,957 and North America up 57% (Check Point Research, April 2025). Check Point’s full-year 2025 figure across all industries was 1,968 per organisation per week (Check Point Cyber Security Report 2026).

7. What the regulators and the Cyber Security and Resilience Bill change

The UK response to Synnovis has been aimed at suppliers rather than trusts, which matches where the incidents have come from.

• CAF-aligned DSPT. From the 2024/25 cycle NHS England moved the Data Security and Protection Toolkit for large health and care organisations onto the NCSC’s Cyber Assessment Framework, with a health and care overlay and a five-year roadmap for the rest of the sector. NHS England does not publish a national compliance rate; each organisation’s status is searchable on the DSPT site (NHS England, 2024).
• Cyber security charter for suppliers, May 2025. NHS England wrote to all current and prospective suppliers asking them to commit to eight principles: patching, DSPT Standards Met, multi-factor authentication, immutable backups, 24/7 monitoring, board-level exercising, timely reporting of patient data loss, and the DSIT and NCSC Software Code of Practice. The charter is voluntary (NHS England; techUK, May 2025).
• Proactive supplier checks, January 2026. A second open letter said that from January 2026 NHS England and contracting authorities may contact suppliers directly to discuss those controls and request evidence, described as risk identification rather than an audit (NHS England, 22 January 2026; techUK).
• Software Code of Practice. The NHS is the first large organisation to build the joint NCSC and DSIT code into its software procurement (NCSC Annual Review 2025).
• Cyber Security and Resilience Bill. The Bill updates the 2018 NIS Regulations, brings medium and large managed service providers and qualifying data centres into scope, lets regulators designate small suppliers of critical goods or services as “critical suppliers” (the minister used Synnovis as the example), and requires an initial incident report within 24 hours and a full report within 72. It passed the Commons and had its Lords second reading on 14 July 2026 (Hansard; check the current stage before publishing).
• Ransomware payment ban. The targeted ban on payments by public sector and critical national infrastructure organisations, including the NHS, was confirmed in July 2025 after almost three quarters of consultation respondents backed it, and awaits legislation (Home Office, 22 July 2025).
• DHSC strategy to 2030. The 2023 strategy commits all health and social care organisations to cyber resilience proportionate to their risk by 2030, and operators of essential services to being “significantly hardened” by the same date (DHSC, March 2023).

In our CREST penetration testing and Health Check work the supplier is usually where the gap is. A trust will have a DSPT submission, a security team and a tested backup; the pathology, patient-record or device vendor it depends on may have none of those, and its only assurance is a questionnaire. For a health supplier the practical baseline is DSPT Standards Met plus Cyber Essentials Plus, with a penetration test of the systems that face the NHS. We certify and test both, and the controls in the January 2026 NHS England letter are a fair description of what a buyer will now ask to see.

Suggested Read: Cyber Essentials for NHS and Healthcare Organisations

Frequently asked questions

How many cyber attacks has the NHS had?

There is no official running total. UK health organisations reported 182 cyber incidents to the ICO in 2025 and 229 in 2024 (our count). DHSC’s NIS records show two 2024 NHS incidents with potential clinical harm to more than 50 patients. The attacks that caused national disruption were WannaCry (2017), Advanced (2022), Dumfries and Galloway and Synnovis (2024) and the Stryker supply disruption (2026).

What was the Synnovis cyber attack?

A Qilin ransomware attack on 3 June 2024 on the pathology provider for Guy’s and St Thomas’ and King’s College Hospital. It postponed 10,152 outpatient appointments and 1,710 elective procedures, cost Synnovis £32.7m in 2024, led to the publication of around 400GB of stolen data, and contributed to one patient’s death at King’s, confirmed in June 2025.

How much did the WannaCry attack cost the NHS?

DHSC’s estimate is £92m: £19m of lost patient care during the week of the attack and £73m of IT costs afterwards. A third of hospital trusts were disrupted and over 19,000 appointments were cancelled (DHSC, 2018).

Which sector reports the most data breaches to the ICO?

Health, with 2,471 reports in 2025, 18% of the total. 93% were non-cyber incidents such as misdirected emails and unauthorised access; 182 were cyber attacks, of which 98 were phishing (our count of the ICO dataset).

How much does a healthcare data breach cost?

Globally, $6.64m on average in 2026, the highest of any industry for the thirteenth year (IBM). In the UK the clearest figures are incident-specific: £32.7m for Synnovis, £92m for WannaCry across the NHS, and a £3.07m ICO fine for Advanced.

Do healthcare organisations pay ransoms?

Fewer than they did. 36% of healthcare ransomware victims paid in 2025 against 61% in 2022, with a median payment of $150,000 (Sophos, global). Synnovis, its two trusts and NHS Dumfries and Galloway all refused, and the government intends to ban payments by public sector bodies including the NHS.

About this data

This page draws on publications dated between March 2023 and October 2026. NHS figures are from NHS England London’s weekly Synnovis impact updates (June to October 2024), NHS England’s March 2026 Stryker supply notice, Synnovis’s 2023 accounts filed at Companies House in January 2025, the NCSC Annual Review 2025 and DHSC’s cyber security strategy to 2030; the WannaCry cost is DHSC’s 2018 estimate. ICO figures are our own count of unique incident references in the ICO data security incident trends dataset (Q1 2019 to Q4 2025), filtered to the Health and Social care sectors. HHS OCR figures are our own count of the OCR breach portal’s archive and open-case exports on 11 October 2026. Survey figures are from DSIT’s Cyber Security Breaches Survey 2025/26 (published 30 April 2026), Sophos’s State of Ransomware in Healthcare 2025 (292 healthcare respondents, 17 countries), IBM’s Cost of a Data Breach Report 2026 and Proofpoint and Ponemon’s 2025 US healthcare study; where a report is global or American we have said so in the line.

Every figure from the 2020 to 2022 US sources that appeared in previous versions of this page has been removed. We refresh this page after each quarterly ICO dataset release, each Cyber Security Breaches Survey (April) and each Sophos healthcare edition (autumn).

If you cite a figure from this page, please link to the original source as well as to us; the references are below.

References

• ICO, Data security incident trends dataset (Q1 2019 to Q4 2025)
• NHS England London, Synnovis ransomware cyber-attack
• NHS England London, update on cyber incident clinical impact (26 September 2024)
• NHS England London, almost all services back on track (4 October 2024)
• NHS England, Synnovis cyber incident
• Digital Health, cyber attack cost Synnovis estimated £32.7m in 2024 (20 January 2025)
• NCSC Annual Review 2025
• Infosecurity Magazine, patient death linked to NHS cyber-attack (26 June 2025)
• Infosecurity Magazine, Qilin publishes Synnovis data (21 June 2024)
• The Register, Synnovis ends investigation (13 November 2025)
• The Record, ransomware attack continues to disrupt healthcare in London (17 April 2026)
• The Record, official UK records confirm cyberattacks put NHS patients at risk of clinical harm (19 May 2025)
• Patient Safety Learning (HSJ), 33,000 patients had data stolen in trust cyber attack (3 June 2026)
• NHS Dumfries and Galloway, cyber attack FAQ
• The Record, NHS Dumfries and Galloway letters to all households (17 June 2024)
• The Record, Wirral hospital group declares major incident (26 November 2024)
• IT Pro, NHS supplier DXS International confirms cyber attack (19 December 2025)
• NHS England, Stryker Medical cyber-attack and disruption to supply (March 2026)
• Digital Health, NHS supplier hit by cyber attack by pro-Iran group (17 March 2026)
• DHSC, Securing cyber resilience in health and care, October 2018 progress update
• DHSC, A cyber resilient health and adult social care system in England: cyber security strategy to 2030 (22 March 2023)
• DSIT, Cyber Security Breaches Survey 2025/26 (30 April 2026)
• ICO, software provider fined £3m following 2022 ransomware attack (27 March 2025)
• Sophos, The State of Ransomware in Healthcare 2025 (October 2025)
• ENISA, Threat Landscape 2025 (October 2025)
• IBM, Cost of a Data Breach Report 2026
• IBM UK, 2026 Cost of a Data Breach UK findings (28 July 2026)
• Proofpoint and Ponemon Institute, Cyber Insecurity in Healthcare 2025 (8 October 2025)
• HHS Office for Civil Rights, Breach Portal
• Verizon, 2026 Data Breach Investigations Report
• Check Point Research, World Health Day 2025: when cyber security fails, so does public health (April 2025)
• Check Point, Cyber Security Report 2026 (February 2026), via iTWire
• NHS England, cyber security charter for suppliers to the NHS (May 2025)
• techUK, NHS England launch cyber security charter (15 May 2025)
• techUK, NHS announces next phase of supply chain engagement (27 January 2026)
• UK Authority, NHS England to adopt Cyber Assessment Framework (3 September 2024)
• Home Office, ransomware legislative proposals: consultation and government response (22 July 2025)
• Hansard, Cyber Security and Resilience Bill, Lords second reading (14 July 2026)
• UK Parliament, Cyber Security and Resilience Bill page