Healthcare Cyberattack Losses Above $200,000 Nearly Quadruple in 12 Months, Netwrix Survey Finds

Netwrix, a cybersecurity provider focused on data and identity threats, today released new findings from its 2025 Cybersecurity Trends Report that reveal sharp increases in cyberattack-related losses across the healthcare sector.

The report found that nearly half (48%) of healthcare organizations experienced at least one cybersecurity incident over the past year. For many, the cost was severe: the share of healthcare respondents reporting losses above $200,000 nearly quadrupled from the previous year, rising from 5% in 2024 to 19% in this year's survey. Losses above $500,000 also spiked, climbing from 2% reported losses last year to 12% this year. By comparison, across all industries in 2025, only 13% reported losses above $200,000 and 6% above $500,000.

Healthcare is being hit harder than other industries because attackers know patient records carry high value and operations can't afford disruption. These attacks often start with compromised credentials, which is why identity has to be the first line of defense for patient data.
Grady Summers, Chief Executive Officer at Netwrix

Phishing, ransomware, and user account compromise were the most common attack types reported - threats that frequently begin with stolen credentials. Nearly one-third of respondents (31%) said their organizations had incidents involving compromised user or admin accounts.

The 2025 survey also asked about AI for the first time. More than a third of IT and security professionals (37%) said AI-driven threats had already forced them to strengthen defenses, showing how quickly adversaries are adopting AI to supercharge phishing and privileged account compromise. Even with greater investment in defenses, the findings suggest attackers - especially those using AI - are evolving faster than many defenders can adapt.

Attackers are moving faster than defenders, and AI is widening that gap. Closing it requires resilience built on an identity-first approach that protects both accounts and the sensitive data they can access.
Jeff Warren, Chief Product Officer at Netwrix

The healthcare findings are part of the Netwrix 2025 Cybersecurity Trends Report, based on a global survey of 2,150 IT and security professionals from 121 countries