At Least 65 Cyberattacks Disrupted Hospital Care Since 2022. But the Federal Registry Isn't Built to Count Them.

Published 10/16/2026

Author: Andrew Reed, Assoc. Director, The Health Management Academy

Key Takeaways

• At least 65 cyberattacks disrupted patient care at US hospitals and health systems between January 2022 and September 2026, about one a month, according to an analysis by The Health Management Academy.

• Ambulances were diverted in 26 cyberattacks. Surgeries, treatments, or appointments were canceled or postponed in 28, and staff switched to paper records in 58.

• Clinical systems stayed offline for a median of 15 days, and five outages lasted a month or longer.

• One in five attacks more than a year old has no entry in the federal breach registry, which tracks exposed patient data and has no way to record disrupted care.

• Healthcare organizations reported a record 776 data breaches to federal regulators in 2025, and 81% of breaches reported from 2022 through 2025 were hacking incidents.

On February 19, 2026, the University of Mississippi Medical Center was hit by a cyberattack that took its Epic electronic health records system offline. Staff switched to paper charts, and all 35 of the center's statewide clinics were forced to close until March 2, according to CNN and the Mississippi Free Press.

The Mississippi attack was one of at least 65 cyberattacks that disrupted patient care at US hospitals and health systems between January 2022 and September 2026, according to a log compiled by The Health Management Academy from news coverage, trade publications, and hospital statements. The attacks reached at least 305 hospitals in 36 states, the District of Columbia, Guam, and the US Virgin Islands. The federal registry lists breaches of patient data affecting 500 or more people and has no field for diverted ambulances, canceled treatments, or closed clinics. Of the disruptive attacks that began more than a year ago, one in five has no entry in it.

How Often Cyberattacks Disrupt Hospital Care

The log counts 11 such attacks in 2022, 21 in 2023, 13 in 2024, 12 in 2025, and eight in 2026 through the end of September. Ambulances were diverted to other hospitals in 26 of the 65 attacks, or 40%. Surgeries, treatments, or appointments were canceled or postponed in 28, or 43%, and clinics or hospital departments closed in 10. In 58 attacks, or 89%, electronic records or other clinical systems went offline and staff worked on paper.

Twenty-one of the attacks hit two or more hospitals at once. The largest, a ransomware attack on a national hospital system in May 2024, took electronic health records offline across roughly 140 hospitals.

The count includes only attacks whose effects on patient care were reported publicly, so the full number is higher. The cybersecurity firm Emsisoft counted 46 hospital systems hit by ransomware in 2023 and 85 in 2024.

Inside a Hospital Under Attack

In another incident, this time on April 6, 2026, the emergency room at Brockton Hospital in Massachusetts stopped accepting ambulances, which were routed to other hospitals. Among other disruptions, chemotherapy infusions were canceled the following day. Three days after the attack, on April 9, the Anubis ransomware group claimed it had stolen two terabytes of patient data. Brockton lifted its code black emergency status on April 15. The disruption made headlines with NBC Boston and HIPAA Journal.

For the 23 attacks where hospitals reported a restoration date, clinical systems stayed down for a median of 15 days. Fourteen of those outages lasted at least two weeks, five lasted at least a month, and the longest ran 41 days.

Patients admitted before an attack begins are more likely to die in the hospital. University of Minnesota researchers found in-hospital mortality rose 34% to 38% for those patients, and hospital volume fell 17% to 24% in the first week, in a study published in the American Economic Journal: Economic Policy in February 2026.

A Cyberattack Can Disrupt Care Without Entering the Registry

The HHS registry records breaches of patient data, not attacks on hospitals. When patient information is exposed, a breach is automatically presumed, and the organization must refute that presumption by showing through a formal risk assessment that there is a low probability the data was compromised. A breach only appears in the database if it affected at least 500 people; therefore, a cyberattack can shut down care delivery for days or weeks before it is known publicly whether any data was compromised.

The Health Management Academy matched each attack in its log against the registry as of September 15, 2026. Among the 55 attacks that began at least a year earlier, 39 have a related filing that lists a patient count. Twelve, or 22%, have no related filing at all, and in five of those 12 the hospital said patient data was not compromised. Four more list only 500 or 501 people, the lowest counts the registry records. Across all 47 attacks with a related filing, seven list exactly 500 or 501 people. Filings arrived a median of 60 days after the attack, and the longest gap spanned 594 days.

From 2016 through 2021, 22.5% of ransomware attacks on US healthcare providers had no entry in the federal registry, according to a 2022 University of Minnesota study in JAMA Health Forum. The same study found that patient care was disrupted in 44% of the attacks it tracked.

Breach Reports Keep Rising

Healthcare organizations reported a record 776 data breaches to federal regulators in 2025, the third straight annual increase. Hacking accounted for 81% of the 2,878 breaches reported from 2022 through 2025.

What Health Systems Can Do

Staff switched to paper records in 58 of the 65 attacks, and where hospitals reported a restoration date, clinical systems stayed down for a median of 15 days. Downtime plans built for that length of outage cover order sets, medication records, and lab and imaging requests that run without the electronic record, along with enough printed supplies and trained staff to keep them going for weeks. In several attacks, hospitals asked patients to bring printed medication lists, insurance cards, prescriptions, and physician orders to appointments, instructions that can be written in advance as part of a downtime plan.

Ambulances were diverted in 26 of the 65 attacks, which pushed patients onto neighboring hospitals. Survival with good neurological function after cardiac arrest outside the hospital fell from 40.0% to 4.5% at two San Diego emergency departments while a neighboring four-hospital system was down after a ransomware attack in 2021, according to University of California San Diego researchers writing in Critical Care Explorations. An earlier study of the same hospitals, published in JAMA Network Open, found that ambulance arrivals rose from 1,741 to 2,354 and stroke code activations rose from 59 to 102 compared with the period before the attack. Regional agreements on how diversion works during a cyberattack, including where stroke, trauma, and cardiac patients go, give EMS agencies and receiving hospitals time to prepare for that surge. Clinical systems stayed down for two weeks or longer in 14 of the 23 attacks with a reported restoration date, and for a month or more in five. Recovery plans sized to that horizon account for staffing paper workflows, manual billing and claims, and the backlog of postponed procedures once systems return.

The federal registry counts exposed patient records and has no field for diverted ambulances, canceled procedures, or days on paper, so no federal dataset tracks how often cyberattacks interrupt care or for how long. Health systems and the companies that support them each hold part of that picture. A shared set of measures, such as days of clinical downtime, hours on diversion, and procedures postponed, would let organizations benchmark their readiness and recovery against peers. The Health Management Academy's Catalyst and Convening programs bring health system and industry leaders together to share data and practices. Programs like these enable health system leaders tocompare their downtime and diversion plans with peers who may have already been through an attack. Health systems and the technology companies they rely on can also agree on what should be tracked following an attack, so the true cost is measured in days of downtime and hours on diversion, not simply by the number of records exposed.

Methodology

The Health Management Academy logged cyberattacks on US hospitals and health systems from January 2022 through September 2026 that had a publicly reported impact on patient care, such as ambulance diversion, canceled care, closures, or electronic health record downtime. Sources were news coverage, trade publications, and hospital statements. Vendor attacks were excluded, and each attack counts once.

Each attack was matched by hand to filings by the same organization, its parent, or an affiliate in the HHS Office for Civil Rights breach portal, using filings through September 15, 2026. Registry shares cover the 55 attacks at least a year old. Filings do not name attacks, so matches rest on organization and timing.

National totals use the full portal as of September 2, 2026, counting filings from the same organization within 90 days as one breach. Reporting on the University of Mississippi Medical Center and Brockton Hospital came from CNN, the Mississippi Free Press, NBC Boston, and HIPAA Journal.