Updated 14 hours ago ()
Threat landscape now
Is the breach problem growing, and what kind of breach is taking over?
In the 12 months to Sep 2026, OCR received 769 breach reports matching this view, down 6% on the year before. Hacking and IT incidents rose from 79% of reports in 2022 to 86% in 2026, while theft and loss went from 4% to 0%. If the recent trend holds, the projection puts the next 12 months at about 782 reports.
What this means for you
Most reportable breaches now begin with an intrusion (86% in 2026), not a lost device. Weight your risk analysis, budget and tabletop exercises to match.
Weight the likelihood ratings in your risk analysis to the current breach mix. If the analysis was written when theft and loss dominated, its top risks are out of date.
Do this next
4 program actions, mapped to HIPAA and NIST CSF 2.0
What this means for your program
- A flat or falling report count does not mean lower exposure: individuals affected is driven by a few very large incidents (Chapter 4).
Volume
How many breaches, and which way the line is heading
Breach reports per month
In the 12 months to Sep 2026 OCR received 769 reports, down 6% on the prior 12 months (818), so the 12-month trend is falling. Individuals affected rose 59% over the same period (145.8M versus 91.9M), a series driven by a handful of very large breaches.
Selected: Jan 2022 to Sep 2026. Drag the handles under the chart to narrow every chart in this chapter to that window.
How this is calculated
Reports are counted by the month OCR received them (submission date), with months that had no reports filled as zero. The line is a trailing 12-month moving average, which removes seasonality and single-month spikes. The headline compares the most recent 12 complete months with the 12 before them; a change within ±5% is called flat. The current calendar month is excluded because its reports are still arriving.
Mix shift
What kind of breach is taking over
Share of breach-type mentions by year
Hacking/IT incidents rose from 79% to 86% of reports between 2022 and 2026 to date, while theft or loss fell from 4% to 0%.
- Hacking/IT Incident
- Unauthorized Access/Disclosure
- Theft
- Loss
- Improper Disposal
How this is calculated
The chart stacks each breach type's share of all type mentions in a year, so each year sums to 100%. OCR lets a report list more than one type, so the finding instead uses the share of reports that list a type (those shares can add to more than 100%). Theft and Loss are combined because both describe a lost or stolen device or record. Years with fewer than 20 matching reports are left out of the comparison.
Reports by year and breach type
Hacking/IT Incident is the tallest ridge: 2,948 reports in this view.
Drag to rotate, scroll or pinch to zoom. Click a bar to open that year and type.
Loading 3D view…
- Hacking/IT Incident
- Unauthorized Access/Disclosure
- Theft
- Loss
- Improper Disposal
How this is calculated
Counts of reports listing each breach type in each submission year (a report listing two types counts in both). The six most frequent types in the view are shown; colours are fixed per type across the site. The table view carries every value.
Outlook
Where it is heading
Reports per month, with a 12-month projection
ProjectionProjection: if the flat trend of the last 36 months (+1% a year) continues, expect about 65 reports a month over the next 12 months (782 in total), with a typical month's 80% band running from 49 to 86.
How this is calculated
A log-linear trend fitted by least squares to log(reports + 1) over the last 36 complete months, after dividing out month-of-year factors from the seasonality card (ratio to a 12-month moving average over the whole selection), which are applied only when that seasonality is statistically clear (chi-square, p < 0.05). The shaded band is the 80% prediction interval from the regression, which widens with distance from the data. It assumes the recent trend and seasonal pattern continue and cannot anticipate changes in OCR reporting rules or a sudden campaign. It is a projection, not a forecast of any particular month.
Seasonal index by calendar month (1.00 = trend)
Over 57 complete months, month-to-month differences from trend are within what chance alone would produce (χ² = 17.2, 11 df), so there is no reliable seasonal peak. 97% of reports are submitted on weekdays, most often on Friday.
How this is calculated
Month-of-year uses classical ratio-to-moving-average decomposition over complete months: each month's reports are compared with the centred 12-month moving average around it, so long-run growth does not make late-year months look busier. The index is observed ÷ trend for each calendar month, rescaled to average 1.00 (1.10 = 10% above trend). A chi-square test of observed against trend-expected counts (11 df) says whether the differences exceed chance; month length is not adjusted, so February reads slightly low. Weekday uses every report in the selection. Caveat: these are submission dates, when OCR received the report; HIPAA allows up to 60 days from discovery, so this is the rhythm of reporting, not of breaches.
For program leaders
Program actions
Each action is mapped to the HIPAA standard it helps you meet (45 CFR Part 164 unless noted) and to the NIST CSF 2.0 function and category it belongs to.
- 1
Re-baseline the risk analysis on hacking, not lost devices
Weight the likelihood ratings in your risk analysis to the current breach mix. If the analysis was written when theft and loss dominated, its top risks are out of date.
- HIPAA
- §164.308(a)(1)(ii)(A) Risk analysis§164.308(a)(1)(ii)(B) Risk management
- NIST CSF 2.0
- Identify · ID.RA Risk AssessmentGovern · GV.RM Risk Management Strategy
- 2
Prove you can restore from ransomware
Keep offline or immutable backups of ePHI systems, test a full restore on a schedule, and time it against the downtime your clinical operations can absorb.
- HIPAA
- §164.308(a)(7)(ii)(A) Data backup plan§164.308(a)(7)(ii)(B) Disaster recovery plan§164.308(a)(7)(ii)(D) Testing and revision procedures
- NIST CSF 2.0
- Protect · PR.DS Data SecurityRecover · RC.RP Incident Recovery Plan Execution
- 3
Patch exploited vulnerabilities on a clock
Track CISA's Known Exploited Vulnerabilities list against your asset inventory and set a remediation deadline for internet-facing systems measured in days, not quarters.
- HIPAA
- §164.308(a)(5)(ii)(B) Protection from malicious software§164.308(a)(1)(ii)(B) Risk management
- NIST CSF 2.0
- Identify · ID.RA Risk AssessmentProtect · PR.PS Platform Security
- 4
Review system activity continuously
Centralise logs from ePHI systems, email and remote access, and review them on a defined cadence so an intrusion is found in days rather than months.
- HIPAA
- §164.308(a)(1)(ii)(D) Information system activity review§164.312(b) Audit controls
- NIST CSF 2.0
- Detect · DE.CM Continuous MonitoringDetect · DE.AE Adverse Event Analysis
For certification candidates
Exam angle
CISSP
- Domain 1: Security and Risk Management
- Domain 7: Security Operations
CISM
- Domain 2: Information Security Risk Management
- Domain 4: Incident Management
CISA
- Domain 4: Information Systems Operations and Business Resilience
Study prompt
A risk register still ranks lost laptops as the top threat while most reported breaches are now hacking incidents. As the security manager, what do you change first: the controls, or the risk analysis that justifies them? Explain why the answer is the risk analysis, and what evidence an auditor would ask for to show it was refreshed.
Lessons learned for this chapter
1,164 resolved OCR cases, filed under ransomware resilience and recovery (874), vulnerability and patch management (39) and audit logging and monitoring (251).