States most impacted by health care data breaches in 2022
Gorodenkoff // Shutterstock
States most impacted by health care data breaches in 2022
Nurse using tablet in hospital ward.
It starts with an often-paralyzing attack on computer systems. Doctors scramble to notify patients awaiting surgery that their procedures have been delayed due to a ransomware attack.
Sometimes a single cyberattack can impact hospitals across multiple states, as was the case when hackers targeted CommonSpirit Health in October 2022. Just one reported case of ransomware has allegedly led to the death of a patient. More often, patients’ sensitive information is served up to a market of seedy individuals around the world ready to cash in on someone else’s identity.
Drata analyzed Department of Health and Human Services data to determine which states felt the largest impacts due to health care data breaches in 2022. The total number of individuals affected by all health care data breaches in each state reported to HHS was normalized as a rate per 10,000 people. Data was not available for Alaska, Idaho, and Washington D.C.
The HITECH Act, signed into federal law in 2009, requires companies to report the breach of protected health information affecting 500 or more people to HHS. Around 38.5 million people in total were affected in some way by the incidents reported to HHS last year. Unfortunately, the data does not make it possible to know how many people may have been affected by more than one breach.
Health care institutions are among the most targeted businesses in the world, chiefly because they hold such sensitive information about the patients they serve. Hospitals, home health agencies, and other institutions store patients’ phone numbers, Social Security numbers, addresses, and other things that would allow any would-be criminal to pose as a patient and open new credit cards or bank accounts in their name.
In fact, roughly 44% of all reported identity theft in 2022 resulted in a fraudulent credit card account being opened, according to Federal Trade Commission data. The agency received a record number of fraud reports in 2021, with the total fraud reports for 2022 coming in on par with 2020. The years 2020 and 2021 marked an important pivot in how consumers shared their personal information, with the adoption of digital banking and retail shopping driven to modern highs as a result of the COVID-19 pandemic.
In 2022, the FBI’s Internet Crime Complaint Center received millions of complaints of cybercrime with losses totaling $10.3 billion. It can take time—even years—for personal information compromised in a data breach to be used for a crime that brings the event to the attention of the FBI.
But the pandemic also drove a rise in cyberattacks on hospitals and other health care businesses. And a good deal of that sensitive information begins its journey into nefarious hands when a hacker illegally accesses information at a health care institution.
Drata
Hacking and IT incidents dominate reasons sensitive information was breached at health care organizations in 2022
Bar chart showing a majority of 2022 health care organization breaches were attributed to hacking or IT incidents.
Sometimes an employee’s oversight in crafting an email with the wrong link or attachment can allow unauthorized access to private information, as happened in Wisconsin’s Department of Health and Human Services last year. However, the vast majority of data breaches at these companies happen through hacking and IT incidents.
Most often, hackers accomplish this with malware that locks up the data until the victim organization pays the attacker a ransom. The federal government recommends against paying ransoms because companies cannot guarantee that a copy of the data won’t be sold to criminals anyway after the ransom is paid, and therefore paying is thought to encourage more of the behavior.
In the top five states where the largest portion of the population was impacted by data breaches at health care organizations last year, all most commonly saw data breaches resulting from hacking.
Sean Pavone // Shutterstock
48. Mississippi
Jackson downtown cityscape at the Capitol.
– People affected per 10,000 residents: 0.4
– Breaches reported: 1
– Most common type of breach: Unauthorized Access/Disclosure
Dawid S Swierczek // Shutterstock
47. Iowa
Historical buildings in downtown Dubuque.
– People affected per 10,000 residents: 0.5
– Breaches reported: 1
– Most common type of breach: Hacking/IT Incident
C Model // Shutterstock
46. Wyoming
City of Jackson Hole and surrounding landscape.
– People affected per 10,000 residents: 2.8
– Breaches reported: 1
– Most common type of breach: Unauthorized Access/Disclosure
Sean Pavone // Shutterstock
45. Virginia
Downtown Richmond skyline on the James River.
– People affected per 10,000 residents: 6.3
– Breaches reported: 20
– Most common type of breach: Hacking/IT Incident
Steven Frame // Shutterstock
44. South Dakota
Sioux Falls park and cityscape.
– People affected per 10,000 residents: 7.4
– Breaches reported: 3
– Most common type of breach: Hacking/IT Incident
Andrey Bayda // Shutterstock
43. Nevada
Aerial view of Las Vegas at evening.
– People affected per 10,000 residents: 8.1
– Breaches reported: 3
– Most common type of breach: Hacking/IT Incident
Joseph Sohm // Shutterstock
42. Maine
Aerial Portland harbor and cityscape.
– People affected per 10,000 residents: 8.6
– Breaches reported: 1
– Most common type of breach: Hacking/IT Incident
Jacob Boomsma // Shutterstock
41. Nebraska
Aerial view of downtown Omaha in autumn.
– People affected per 10,000 residents: 11.2
– Breaches reported: 6
– Most common type of breach: Hacking/IT Incident
Sean Pavone // Shutterstock
40. Connecticut
Skyline of downtown Hartford from above Charter Oak Landing.
– People affected per 10,000 residents: 13.2
– Breaches reported: 7
– Most common type of breach: Hacking/IT Incident
IMG_191 // Shutterstock
39. Minnesota
Rochester skyline reflected in river.
– People affected per 10,000 residents: 13.3
– Breaches reported: 6
– Most common type of breach: Hacking/IT Incident
AevanStock // Shutterstock
38. Florida
Downtown city skyline view of Tampa.
– People affected per 10,000 residents: 13.7
– Breaches reported: 23
– Most common type of breach: Hacking/IT Incident
Susanne Pommer // Shutterstock
37. South Carolina
Downtown Charleston street view.
– People affected per 10,000 residents: 16.8
– Breaches reported: 5
– Most common type of breach: Hacking/IT Incident
Real Window Creative // Shutterstock
36. Maryland
Aerial view of Annapolis and Statehouse.
– People affected per 10,000 residents: 17.1
– Breaches reported: 11
– Most common type of breach: Hacking/IT Incident
turtix // Shutterstock
35. New Mexico
Albuquerque residential suburbs.
– People affected per 10,000 residents: 21
– Breaches reported: 1
– Most common type of breach: Hacking/IT Incident
Real Window Creative // Shutterstock
34. Delaware
Aerial view of Wilmington.
– People affected per 10,000 residents: 21.6
– Breaches reported: 3
– Most common type of breach: Hacking/IT Incident
Sean Pavone // Shutterstock
33. Rhode Island
Providence cityscape.
– People affected per 10,000 residents: 22.7
– Breaches reported: 5
– Most common type of breach: Hacking/IT Incident
photo.ua // Shutterstock
32. Ohio
Cincinnati skyline and bridge.
– People affected per 10,000 residents: 24.3
– Breaches reported: 20
– Most common type of breach: Hacking/IT Incident
Kamira // Shutterstock
31. New Jersey
Aerial view of Jersey City.
– People affected per 10,000 residents: 29.1
– Breaches reported: 22
– Most common type of breach: Hacking/IT Incident
Brett Barnhill // Shutterstock
30. Georgia
Aerial view of Atlanta metro and highways.
– People affected per 10,000 residents: 29.3
– Breaches reported: 17
– Most common type of breach: Hacking/IT Incident
Eduardo Medrano // Shutterstock
29. Arkansas
Afternoon Little Rock cityscape.
– People affected per 10,000 residents: 29.4
– Breaches reported: 4
– Most common type of breach: Hacking/IT Incident
MNStudio // Shutterstock
28. Hawaii
Honolulu waterfront and cityscape.
– People affected per 10,000 residents: 40.9
– Breaches reported: 3
– Most common type of breach: Hacking/IT Incident
Canva
27. Utah
Aerial view of Salt Lake City.
– People affected per 10,000 residents: 41.1
– Breaches reported: 4
– Most common type of breach: Hacking/IT Incident
Joe Hendrickson // Shutterstock
26. Missouri
Aerial view of The Gateway Arch and riverfront in downtown St. Louis.
– People affected per 10,000 residents: 44.5
– Breaches reported: 9
– Most common type of breach: Hacking/IT Incident
Canva
25. California
Tower Bridge and Capitol Mall.
– People affected per 10,000 residents: 49.4
– Breaches reported: 31
– Most common type of breach: Hacking/IT Incident
Sean Pavone // Shutterstock
24. Alabama
Birmingham skyline at dusk.
– People affected per 10,000 residents: 59.5
– Breaches reported: 5
– Most common type of breach: Hacking/IT Incident
Jacob Boomsma // Shutterstock
23. Kansas
Aerial view downtown Wichita.
– People affected per 10,000 residents: 76.2
– Breaches reported: 8
– Most common type of breach: Hacking/IT Incident
Canva
22. New York
New York City skyline.
– People affected per 10,000 residents: 81.8
– Breaches reported: 43
– Most common type of breach: Hacking/IT Incident
CrackerClips Stock Media // Shutterstock
21. Tennessee
Knoxville skyline with Worlds Fair Park.
– People affected per 10,000 residents: 83.5
– Breaches reported: 11
– Most common type of breach: Hacking/IT Incident
Canva
20. Louisiana
Aerial photo of Baton Rouge State Capitol Park.
– People affected per 10,000 residents: 87.4
– Breaches reported: 3
– Most common type of breach: Hacking/IT Incident
Derek Olson Photography // Shutterstock
19. North Carolina
Asheville skyline in the fall.
– People affected per 10,000 residents: 87.9
– Breaches reported: 18
– Most common type of breach: Hacking/IT Incident
Erika J Mitchell // Shutterstock
18. Vermont
Burlington waterfront view and cityscape.
– People affected per 10,000 residents: 91.8
– Breaches reported: 1
– Most common type of breach: Hacking/IT Incident
Josemaria Toscano // Shutterstock
17. Oregon
Portland cityscape from Pittock Mansion.
– People affected per 10,000 residents: 94.5
– Breaches reported: 6
– Most common type of breach: Hacking/IT Incident
Canva
16. Oklahoma
Downtown Oklahoma City.
– People affected per 10,000 residents: 97.8
– Breaches reported: 4
– Most common type of breach: Hacking/IT Incident
Wangkun Jia // Shutterstock
15. New Hampshire
Aerial view of Market Square and North Church in Portsmouth.
– People affected per 10,000 residents: 116.8
– Breaches reported: 8
– Most common type of breach: Hacking/IT Incident
kan_khampanya// Shutterstock
14. Washington
Elevated view of Seattle Space Needle and downtown.
– People affected per 10,000 residents: 136.6
– Breaches reported: 18
– Most common type of breach: Hacking/IT Incident
kintermedia // Shutterstock
13. Texas
Aerial view of cityscape and highways.
– People affected per 10,000 residents: 139.7
– Breaches reported: 40
– Most common type of breach: Hacking/IT Incident
f11photo // Shutterstock
12. Kentucky
Louisville cityscape.
– People affected per 10,000 residents: 140.3
– Breaches reported: 3
– Most common type of breach: Hacking/IT Incident
marchello74 // Shutterstock
11. Illinois
Chicago neighborhood buildings and city skyline on sunny autumn day.
– People affected per 10,000 residents: 188.5
– Breaches reported: 21
– Most common type of breach: Hacking/IT Incident
Jon Bilous // Shutterstock
10. Montana
View of Missoula from Mount Sentinel.
– People affected per 10,000 residents: 196.1
– Breaches reported: 2
– Most common type of breach: Hacking/IT Incident
Gerald Bernard // Shutterstock
9. Michigan
Park and skyscrapers in downtown Detroit.
– People affected per 10,000 residents: 208.6
– Breaches reported: 21
– Most common type of breach: Hacking/IT Incident
Gregory E. Clifford // Shutterstock
8. Arizona
Scenic view of Phoenix.
– People affected per 10,000 residents: 213.2
– Breaches reported: 9
– Most common type of breach: Hacking/IT Incident
Real Window Creative // Shutterstock
7. Pennsylvania
Pennsylvania State Capitol building.
– People affected per 10,000 residents: 232.8
– Breaches reported: 27
– Most common type of breach: Hacking/IT Incident
KYPhua // Shutterstock
6. Indiana
Indianapolis skyline seen from canal walkway.
– People affected per 10,000 residents: 306.1
– Breaches reported: 14
– Most common type of breach: Hacking/IT Incident
lunamarina // Shutterstock
5. Massachusetts
Boston skyline with river.
– People affected per 10,000 residents: 335.5
– Breaches reported: 13
– Most common type of breach: Hacking/IT Incident
Studio 1One // Shutterstock
4. Colorado
Denver cityscape.
– People affected per 10,000 residents: 395.8
– Breaches reported: 9
– Most common type of breach: Hacking/IT Incident
Jacob Boomsma // Shutterstock
3. North Dakota
Aerial view of Grand Forks.
– People affected per 10,000 residents: 655.2
– Breaches reported: 1
– Most common type of breach: Hacking/IT Incident
Canva
2. West Virginia
Aerial view of Morgantown.
– People affected per 10,000 residents: 703.9
– Breaches reported: 7
– Most common type of breach: Hacking/IT Incident
Tony Savino // Shutterstock
1. Wisconsin
Milwaukee cityscape with Art Museum with the Northwestern Mutual building.
– People affected per 10,000 residents: 743.2
– Breaches reported: 9
– Most common type of breach: Hacking/IT Incident
Data reporting by Dom DiFurio. Story editing by Jeff Inglis. Copy editing by Tim Bruns. Photo selection by Elizabeth Ciano.
This story originally appeared on Drata and was produced and
distributed in partnership with Stacker Studio.
