Ransomware Attacks on US Healthcare Jumped 64% Last Quarter. Most Victims Never Confirm It.

Ransomware crews found healthcare again. Attacks and unverified ransomware claims targeting U.S. healthcare organizations jumped 64 percent in the third quarter of 2026 compared to the second quarter, according to an October 15 report from cybersecurity research firm Comparitech. The numbers describe an industry under sustained, accelerating assault, and a measurement problem that makes the true scale hard to see.

Between July and September, Comparitech tracked 306 healthcare ransomware incidents and claims worldwide. The United States accounted for 185 of them. Globally, incidents rose 40 percent from the 219 tracked in the second quarter, and more than doubled from 151 in the same period of 2025.

The confirmed and the claimed

The most important distinction in the report is between confirmed attacks and unverified claims. Of the 306 worldwide incidents, only 53 were confirmed. The remaining 253 were claims by ransomware groups that the targeted organizations have not acknowledged. Comparitech counts an incident as confirmed when an organization publicly acknowledges ransomware involvement or reports a cyberattack consistent with a group's claim.

This gap is not a statistical quirk. It is the shape of the modern ransomware economy. Many groups now run leak sites where they name alleged victims and threaten to publish stolen data, whether or not they encrypted anything. Some claims are real breaches the victim is quietly handling. Others are exaggerations or outright fabrications designed to pressure a payment. Defenders have to treat every claim as potentially real, which is exactly the point.

Only 53 of 306 tracked healthcare incidents were confirmed. The other 253 are claims, and defenders must treat every one as potentially real. That is the point.

Where the damage lands

Hospitals, clinics, and other direct-care providers bore the brunt: 192 of the global incidents involved them, with 40 confirmed attacks and 152 unconfirmed claims. In the confirmed provider attacks alone, Comparitech identified 618,149 patient records known to have been compromised. That figure counts only what is confirmed, which means it is a floor, not a ceiling.

The remaining 114 incidents hit businesses operating in healthcare: medical manufacturers, billing companies, and technology providers. Thirteen were confirmed. These supply-chain targets matter because a single compromised vendor can expose dozens of provider customers downstream, a pattern the industry has seen repeatedly.

Faster than everything else

What makes the healthcare numbers stand out is the comparison. Comparitech's broader research found ransomware up 29 percent quarter over quarter and 61 percent year over year across all industries. Healthcare's 64 percent quarterly jump in the U.S. and 40 percent globally outpaced both. Attackers are not just doing more ransomware. They are disproportionately aiming it at hospitals.

The reasons are grim and well understood. Healthcare organizations cannot tolerate downtime, which makes them more likely to pay. Their networks are complex, their IT budgets are thin relative to the sensitivity of their data, and their systems are full of legacy equipment that cannot be patched or replaced easily. Medical devices with decade-old software sit on the same networks as billing systems, and every connected infusion pump is a potential foothold.

What the numbers demand

The report lands in a quarter already crowded with healthcare incidents. Ransomware groups have been naming medical targets steadily, and the data-theft extortion model, where nothing is encrypted but data is threatened with release, has made the old advice about backups necessary but insufficient. You cannot restore your way out of a leak.

For healthcare security teams, the practical takeaways are familiar but urgent: segment networks so a compromised workstation cannot reach clinical systems, maintain offline backups, monitor for data exfiltration rather than just encryption, and rehearse incident response for the scenario where the attacker never locks a single file. The 253 unconfirmed claims are a reminder that the first sign of an incident may be someone else's leak site, not your own alarms.

The economics of the target

There is a reason ransomware economics favor hospitals. A manufacturer hit by ransomware loses production; a hospital hit by ransomware risks lives. That asymmetry shows up in payment decisions, and attackers price it in. Healthcare data is also unusually valuable on secondary markets: a complete medical record contains identity, insurance, and payment details in one package, worth far more than a bare credit card number.

The sector's structure compounds the risk. Consolidation has created large health systems running heterogeneous IT estates stitched together from acquisitions, each with its own legacy systems and security practices. Attackers do not need to breach the flagship hospital. They need one poorly defended clinic in the network, and the trust relationships between systems do the rest.

For everyone else, the healthcare surge is a preview. The tactics refined against hospitals, double extortion, supply-chain targeting, leak-site pressure, migrate to other sectors within months. What happened to healthcare in Q3 is a forecast for the rest of the economy in Q4.