The most expensive security breaches in healthcare rarely began with a genius attacker fidgeting on their laptop. They begin with something ordinary.
A password reused from another site, a server without MFA switched on, or an update that was patched, these are the usual culprits.
I have spent years on the response side of these incidents, and once you have seen enough of them, the pattern becomes almost monotonous.
For the past 14 years, healthcare has been the most expensive industry for data breaches. If you’re in charge of security at a healthcare clinic or organization, healthtech vendor touching PHI, this stat should concern you.
In this blog, we highlight the important aspects of the largest breaches and their impact, along with the major causes that still persist. Below we talk about seven of the most consequential security breaches in healthcare, each paired with a compliance expert’s read on what it actually teaches.
Read these as case files because the lesson is never in the drama. The mistakes were not because of the size of the organizations, and neither are the fixes.
1. Change Healthcare (2024): One Vendor’s Missing MFA Brings a Nation to a Halt
The Change Healthcare data breach was the largest data breach in healthcare history.
In February 2024, attackers tied to the ALPHV/BlackCat ransomware group used stolen credentials to log into a Change Healthcare remote-access portal that did not have multi-factor authentication enabled.
Change Healthcare processes a large share of U.S. medical claims, so the impact was felt nationally. From healthcare claims to patient-care workflows, key operations were disrupted for months.
The final count reported to HHS’ Office for Civil Rights reached 192.7 million individuals, which is close to two-thirds of the country, making it the largest healthcare data breach ever recorded. Change Healthcare’s parent company UnitedHealth Group’s own filings put the cost above $2.45 billion, including a $22 million ransom.
The detail that should keep every security leader awake is not the “192.7 million” individuals whose data got compromised. It is that single server without an MFA.
Congressional testimony confirmed the same. One control on one system at one vendor, and a third of American healthcare’s billing stopped. When you outsource a function, you can’t ignore their risk. You bring their risk into your own house.
Healthcare compliance experts will tell you to review where your data goes in a vendor’s system, and whether you have ever verified their controls, or just trusted their logo on a signed agreement?
2. Anthem (2015): The Breach That Took Only a Click
Before the Change Healthcare data breach, there was Anthem almost a decade ago.
A spear-phishing email to an Anthem subsidiary gave attackers a foothold inside its system. From there, they moved laterally until they reached a database holding health records of 78.8 million members.
These records included names, Social Security numbers, dates of birth, and medical IDs. These are PHI under HIPAA laws, and thus it brought scrutiny from OCR.
Anthem settled the matter with OCR for $16 million, which is still the largest HIPAA settlement on record. Anthem also paid $115 million to resolve class-action claims and $48.2 million to state attorneys general.
Taking aside Anthem’s obvious financial loses, let’s look at the technical side. If anything, this data breach proved that it only takes one click.
A single malicious email link, and the attacker could reach 78.8 million records. Nothing stops it anywhere else in the system.
That’s why segmentation and monitoring are important. They decide whether a phishing attack becomes a contained incident or a catastrophe.
When assessing a smaller environment, you should be less interested in whether you can block every phishing email (which you can’t) and far more interested in what an attacker can actually touch after the first click.
3. Community Health Systems (2014): The Free Fix That Nobody Applied
Investigators tied this one to the Heartbleed vulnerability.
Heartbleed, officially referenced as CVE-2014-0160, was a bug in OpenSSL’s TLS/DTLS heartbleed extension (hence the name). When exploited, it leads to the leak of memory contents from the server to the client and from the client to the server.
The Heartbleed vulnerability was patched immediately after it was discovered. The fix requires upgrading the OpenSSL library to version 1.0.1g or later and revoking compromised security keys.
Attackers exploited an unpatched device still vulnerable to Heartbleed, pulled credentials from its memory, used them on the VPN, and worked their way to 4.5 million patient records.
Cybersecurity firm Mandiant attributed the intrusion to a foreign-linked group. It is widely cited as the first major breach linked to a Heartbleed exploit, and the vendor had shipped a patch within days of Heartbleed becoming public.
You will find that this is the cheapest breach that could have been prevented on the entire list. And exactly why this case worth noting.
The fix existed, and it was free. And yet, it was simply not applied. Federal health-sector reporting now puts unpatched software vulnerabilities behind roughly one in five healthcare ransomware attacks.
Honestly, patch management is a boring, thankless job. But it is the difference between just another day and a major system hijack.
A pentest that is automated and continuous will not find unpatched devices with credentials sitting in memory. That can only be found in a manual pentest.
4. HCA Healthcare (2023): The Patient Data That Was Forgotten
In July 2023, HCA Healthcare, one of the largest hospital operators in the country, disclosed that an unauthorized party had stolen data on roughly 11.27 million patients across 20 states and posted it for sale on a hacking forum.
Interestingly, the data did not come from clinical systems or a patient portal. It came from an external storage location used purely to automate the formatting of routine emails, such as appointment reminders.
The exposed rows held names, addresses, email addresses, phone numbers, dates of birth, and upcoming appointment details. HCA stated that no clinical records, payment data, or Social Security numbers were involved. Yet eleven million people were exposed through a system almost nobody thought of as sensitive.
This is the breach that lives in everyone’s blind spot. Most of the attention is given to the EHR or the billing platform. Then someone copies a slice of patient data into an external drive to format emails, and that forgotten copy becomes the breach.
I call it shadow data, and almost every organization I assess has it. From exports sitting in a marketing tool to a spreadsheet on a shared drive, you need to know where your data goes.
You cannot protect what you have never mapped. Healthcare compliance experts will tell you to ask two questions to prevent a repeat of the HCA breach: where does a copy of patient data actually live and does every one of those places have implemented the controls outlined in the Business Associate Agreement?
5. 23andMe (2023): When a Product Feature for Genetic Matches Multiplies the Attack Surface
In late 2023, 23andMe suffered a massive data breach. Attackers ran a credential-stuffing campaign, using username and password pairs leaked from other companies’ breaches to get into about 14,000 accounts.
Now, those accounts had a feature that allowed users to match with their blood relations. That feature let the attackers to scrape data on roughly 6.9 million people, including genetic and ancestry information.
California’s attorney general concluded that 23andMe failed to implement reasonable safeguards. The company later filed for bankruptcy, and victim compensation of roughly $46.75 million is being paid out of the bankruptcy estate.
The reason to put a genetics company on a healthcare list is because the lesson here is universal. Features can also be attack surfaces.
A relative-matching feature was a product decision that quietly turned 14,000 compromised logins into 6.9 million victims. Every “share,” “connect,” and “sync” toggle in your product runs in the same way.
The entry method of credential stuffing is defeated outright by MFA, which the company never required. And the hardest part about breaches such as these is that the data cannot be made safe after it has leaked, and the company that held it no longer exists. Some breaches you do not recover from.
6. Kaiser Permanente (2024): The Breach Where Nobody Felt Hacked
There was no ransomware attack here. Nor were there any stolen credentials or intruders in the system.
Kaiser’s own websites and apps carried third-party tracking technologies, namely pixels, that transmitted the data of around 13.4 million people to advertisers including Google, Microsoft, and X.
It was reported to HHS as the year’s largest health data breach at the time, and the largest confirmed breach tied to website tracking technology. Kaiser reached a settlement of up to $47.5 million.
This kind of data breach is catching people off guard since nobody is feeling “breached.” A marketing team added a tracking pixel to improve a campaign, and a healthcare organization unwittingly disclosed a 13-million record. There was no villain to blame it on.
Interestingly enough, OCR has been steadily pursuing this exact pattern of PHI flowing to advertising and analytics vendors without a BAA.
PHI leaving through analytics and ad tools is now one of OCR’s most active enforcement areas. If today you cannot say exactly which third-party scripts run on the pages where patients log in or search symptoms, you have a Kaiser-shaped gap.
Healthcare security compliance is not only about keeping attackers out. It is about knowing where your data goes when everything feels like they are working normally.
7. Ascension (2024): When a Breach Became a Patient-Safety Issue
In May 2024, an employee downloaded a file they believed was legitimate. It opened the door to a ransomware attack that took down electronic health records, phone systems, and the systems used to order medications and tests across Ascension’s 140 hospitals.
The culprits were linked to the Black Basta group. After the attack, the staff reverted to paper. Ambulances were diverted, and procedures were postponed. About 5.6 million people had their data stolen.
But the more important stat is the number of weeks patient received degraded care. Wherever there is a ransomware demand, or a system disruption, it costs patient care.
Ransomware inside a hospital is a patient-safety problem. The real question for a healthcare organization is not only “can attackers get our data,” but “can we still treat patients on the day the systems are gone?”
Tested backups, written downtime procedures, and a rehearsed incident response plan are clinical safeguards, not just IT ones. That is the mindset shift the last two years have forced upon everyone in healthcare.
What Can SMBs Do as the Bar for Healthcare Security Rises?
If these cases feel like they are only about giant organizations, here is the uncomfortable truth: these are also happening to the SMBs, just the scale is different.
Relatively, the threat is the same.
And it’s a myth that attackers only chase the Anthems and the Change Healthcares.
In fact, they now know that it’s much easier to target and get data from a 5-facility hospital group in North Carolina or Arizona, rather than go for a well-funded and decently staffed multi-state hospital chain spanning across the US.
And if you’re a vendor to healthcare organizations, they are coming after you even more.
Credential stuffing, unpatched edge devices, missing MFA, and over-shared vendor access, none of these depend on the size of your organization. You do not fix this by buying more tools. Across all seven cases, the controls that would have changed the outcome are unglamorous and almost always within reach.
Lean teams often have to deal with more of it, not less. Here is the sequence they should follow:
- Refresh your security risk analysis: It identifies everything else on this list and is the control regulators look for first.
- Put MFA on every path to ePHI: Remote access, VPN, EHR, cloud, and admin accounts all require MFA. There should be no exceptions for what you deem as “low-risk.” Remember, Change Healthcare started with a missing MFA on a Citrix server.
- Build and maintain an asset inventory and data-flow map: You cannot protect data you haven’t located. This is how HCA and Kaiser got caught.
- Review your business associate agreements and your vendors: Confirm who touches PHI and how they treat it, that BAAs exist, and that ad-tech and analytics tools aren’t quietly exfiltrating it. See our note on HIPAA requirements for digital health products.
- Patch on a schedule and validate externally: Pair scanning with periodic manual penetration testing so you find the CHS-style gaps before an attacker does.
- Segment the network and rehearse downtime: Limit blast radius, test backups, and run the paper-charting drill before you need it.
How Can KLEAP Help?
Every breach above had a control that was known and available, but never put in place. That is exactly the gap KLEAP’s concierge model is designed to close.
KLEAP works with healthcare and healthtech organizations as a dedicated, embedded extension of your team. We are not a rotating bench of analysts or an automated platform that hands you a dashboard and a readiness score.
A single KLEAP expert owns your engagement end to end, starting where regulators start: a documented security risk analysis that maps where your data actually lives, who can reach it, and what is missing. It is the control OCR cited in Anthem’s $16 million settlement, and it is the foundation everything else builds on.
From there, we pair that analysis with manual penetration testing that finds the unpatched VPN, the unmanaged legacy portal, or the exposed vendor system before an attacker does. For organizations that need ongoing strategic guidance, our services keep your compliance posture current.
This involves reviewing business associate agreements, evaluating data flows (including the ad-tech blind spots Kaiser learned about the hard way), and helping you build the resilience and downtime readiness Ascension had to improvise.
If you want a candid read on where your program stands against the failures above, start a conversation with our team today.
