Breaking News

States most impacted by health care data breaches in 2022

Table of Contents

SIOUX FALLS, S.D. (STACKER) — It starts with an often-paralyzing attack on computer systems. Doctors scramble to notify patients awaiting surgery that their procedures have been delayed due to a ransomware attack.

Sometimes a single cyberattack can impact hospitals across multiple states, as was the case when hackers targeted CommonSpirit Health in October 2022. Just one reported case of ransomware has allegedly led to the death of a patient. More often, patients’ sensitive information is served up to a market of seedy individuals around the world ready to cash in on someone else’s identity.

Drata analyzed Department of Health and Human Services data to determine which states felt the largest impacts due to health care data breaches in 2022. The total number of individuals affected by all health care data breaches in each state reported to HHS was normalized as a rate per 10,000 people. Data was not available for Alaska, Idaho, and Washington D.C.

The HITECH Act, signed into federal law in 2009, requires companies to report the breach of protected health information affecting 500 or more people to HHS. Around 38.5 million people in total were affected in some way by the incidents reported to HHS last year. Unfortunately, the data does not make it possible to know how many people may have been affected by more than one breach.

Health care institutions are among the most targeted businesses in the world, chiefly because they hold such sensitive information about the patients they serve. Hospitals, home health agencies, and other institutions store patients’ phone numbers, Social Security numbers, addresses, and other things that would allow any would-be criminal to pose as a patient and open new credit cards or bank accounts in their name.

In fact, roughly 44% of all reported identity theft in 2022 resulted in a fraudulent credit card account being opened, according to Federal Trade Commission data. The agency received a record number of fraud reports in 2021, with the total fraud reports for 2022 coming in on par with 2020. The years 2020 and 2021 marked an important pivot in how consumers shared their personal information, with the adoption of digital banking and retail shopping driven to modern highs as a result of the COVID-19 pandemic.

In 2022, the FBI’s Internet Crime Complaint Center received millions of complaints of cybercrime with losses totaling $10.3 billion. It can take time—even years—for personal information compromised in a data breach to be used for a crime that brings the event to the attention of the FBI.

But the pandemic also drove a rise in cyberattacks on hospitals and other health care businesses. And a good deal of that sensitive information begins its journey into nefarious hands when a hacker illegally accesses information at a health care institution.Bar chart showing a majority of 2022 health care organization breaches were attributed to hacking or IT incidents.

Drata

Hacking and IT incidents dominate reasons sensitive information was breached at health care organizations in 2022

Sometimes an employee’s oversight in crafting an email with the wrong link or attachment can allow unauthorized access to private information, as happened in Wisconsin’s Department of Health and Human Services last year. However, the vast majority of data breaches at these companies happen through hacking and IT incidents.

Most often, hackers accomplish this with malware that locks up the data until the victim organization pays the attacker a ransom. The federal government recommends against paying ransoms because companies cannot guarantee that a copy of the data won’t be sold to criminals anyway after the ransom is paid, and therefore paying is thought to encourage more of the behavior.

In the top five states where the largest portion of the population was impacted by data breaches at health care organizations last year, all most commonly saw data breaches resulting from hacking.Jackson downtown cityscape at the Capitol.

Sean Pavone // Shutterstock

48. Mississippi

– People affected per 10,000 residents: 0.4
– Breaches reported: 1
– Most common type of breach: Unauthorized Access/DisclosureHistorical buildings in downtown Dubuque.

Dawid S Swierczek // Shutterstock

47. Iowa

– People affected per 10,000 residents: 0.5
– Breaches reported: 1
– Most common type of breach: Hacking/IT IncidentCity of Jackson Hole and surrounding landscape.

C Model // Shutterstock

46. Wyoming

– People affected per 10,000 residents: 2.8
– Breaches reported: 1
– Most common type of breach: Unauthorized Access/DisclosureDowntown Richmond skyline on the James River.

Sean Pavone // Shutterstock

45. Virginia

– People affected per 10,000 residents: 6.3
– Breaches reported: 20
– Most common type of breach: Hacking/IT IncidentSioux Falls park and cityscape.

Steven Frame // Shutterstock

44. South Dakota

– People affected per 10,000 residents: 7.4
– Breaches reported: 3
– Most common type of breach: Hacking/IT IncidentAerial view of Las Vegas at evening.

Andrey Bayda // Shutterstock

43. Nevada

– People affected per 10,000 residents: 8.1
– Breaches reported: 3
– Most common type of breach: Hacking/IT IncidentAerial Portland harbor and cityscape.

Joseph Sohm // Shutterstock

42. Maine

– People affected per 10,000 residents: 8.6
– Breaches reported: 1
– Most common type of breach: Hacking/IT IncidentAerial view of downtown Omaha in autumn.

Jacob Boomsma // Shutterstock

41. Nebraska

– People affected per 10,000 residents: 11.2
– Breaches reported: 6
– Most common type of breach: Hacking/IT IncidentSkyline of downtown Hartford from above Charter Oak Landing.

Sean Pavone // Shutterstock

40. Connecticut

– People affected per 10,000 residents: 13.2
– Breaches reported: 7
– Most common type of breach: Hacking/IT IncidentRochester skyline reflected in river.

IMG_191 // Shutterstock

39. Minnesota

– People affected per 10,000 residents: 13.3
– Breaches reported: 6
– Most common type of breach: Hacking/IT IncidentDowntown city skyline view of Tampa.

AevanStock // Shutterstock

38. Florida

– People affected per 10,000 residents: 13.7
– Breaches reported: 23
– Most common type of breach: Hacking/IT IncidentDowntown Charleston street view.

Susanne Pommer // Shutterstock

37. South Carolina

– People affected per 10,000 residents: 16.8
– Breaches reported: 5
– Most common type of breach: Hacking/IT IncidentAerial view of Annapolis and Statehouse.

Real Window Creative // Shutterstock

36. Maryland

– People affected per 10,000 residents: 17.1
– Breaches reported: 11
– Most common type of breach: Hacking/IT IncidentAlbuquerque residential suburbs.

turtix // Shutterstock

35. New Mexico

– People affected per 10,000 residents: 21
– Breaches reported: 1
– Most common type of breach: Hacking/IT IncidentAerial view of Wilmington.

Real Window Creative // Shutterstock

34. Delaware

– People affected per 10,000 residents: 21.6
– Breaches reported: 3
– Most common type of breach: Hacking/IT IncidentProvidence cityscape.

Sean Pavone // Shutterstock

33. Rhode Island

– People affected per 10,000 residents: 22.7
– Breaches reported: 5
– Most common type of breach: Hacking/IT IncidentCincinnati skyline and bridge.

photo.ua // Shutterstock

32. Ohio

– People affected per 10,000 residents: 24.3
– Breaches reported: 20
– Most common type of breach: Hacking/IT IncidentAerial view of Jersey City.

Kamira // Shutterstock

31. New Jersey

– People affected per 10,000 residents: 29.1
– Breaches reported: 22
– Most common type of breach: Hacking/IT IncidentAerial view of Atlanta metro and highways.

Brett Barnhill // Shutterstock

30. Georgia

– People affected per 10,000 residents: 29.3
– Breaches reported: 17
– Most common type of breach: Hacking/IT IncidentAfternoon Little Rock cityscape.

Eduardo Medrano // Shutterstock

29. Arkansas

– People affected per 10,000 residents: 29.4
– Breaches reported: 4
– Most common type of breach: Hacking/IT IncidentHonolulu waterfront and cityscape.

MNStudio // Shutterstock

28. Hawaii

– People affected per 10,000 residents: 40.9
– Breaches reported: 3
– Most common type of breach: Hacking/IT IncidentAerial view of Salt Lake City.

Canva

27. Utah

– People affected per 10,000 residents: 41.1
– Breaches reported: 4
– Most common type of breach: Hacking/IT IncidentAerial view of The Gateway Arch and riverfront in downtown St. Louis.

Joe Hendrickson // Shutterstock

26. Missouri

– People affected per 10,000 residents: 44.5
– Breaches reported: 9
– Most common type of breach: Hacking/IT IncidentTower Bridge and Capitol Mall.

Canva

25. California

– People affected per 10,000 residents: 49.4
– Breaches reported: 31
– Most common type of breach: Hacking/IT IncidentBirmingham skyline at dusk.

Sean Pavone // Shutterstock

24. Alabama

– People affected per 10,000 residents: 59.5
– Breaches reported: 5
– Most common type of breach: Hacking/IT IncidentAerial view downtown Wichita.

Jacob Boomsma // Shutterstock

23. Kansas

– People affected per 10,000 residents: 76.2
– Breaches reported: 8
– Most common type of breach: Hacking/IT IncidentNew York City skyline.

Canva

22. New York

– People affected per 10,000 residents: 81.8
– Breaches reported: 43
– Most common type of breach: Hacking/IT IncidentKnoxville skyline with Worlds Fair Park.

CrackerClips Stock Media // Shutterstock

21. Tennessee

– People affected per 10,000 residents: 83.5
– Breaches reported: 11
– Most common type of breach: Hacking/IT IncidentAerial photo of Baton Rouge State Capitol Park.

Canva

20. Louisiana

– People affected per 10,000 residents: 87.4
– Breaches reported: 3
– Most common type of breach: Hacking/IT IncidentAsheville skyline in the fall.

Derek Olson Photography // Shutterstock

19. North Carolina

– People affected per 10,000 residents: 87.9
– Breaches reported: 18
– Most common type of breach: Hacking/IT IncidentBurlington waterfront view and cityscape.

Erika J Mitchell // Shutterstock

18. Vermont

– People affected per 10,000 residents: 91.8
– Breaches reported: 1
– Most common type of breach: Hacking/IT IncidentPortland cityscape from Pittock Mansion.

Josemaria Toscano // Shutterstock

17. Oregon

– People affected per 10,000 residents: 94.5
– Breaches reported: 6
– Most common type of breach: Hacking/IT IncidentDowntown Oklahoma City.

Canva

16. Oklahoma

– People affected per 10,000 residents: 97.8
– Breaches reported: 4
– Most common type of breach: Hacking/IT IncidentAerial view of Market Square and North Church in Portsmouth.

Wangkun Jia // Shutterstock

15. New Hampshire

– People affected per 10,000 residents: 116.8
– Breaches reported: 8
– Most common type of breach: Hacking/IT IncidentElevated view of Seattle Space Needle and downtown.

kan_khampanya// Shutterstock

14. Washington

– People affected per 10,000 residents: 136.6
– Breaches reported: 18
– Most common type of breach: Hacking/IT IncidentAerial view of cityscape and highways.

kintermedia // Shutterstock

13. Texas

– People affected per 10,000 residents: 139.7
– Breaches reported: 40
– Most common type of breach: Hacking/IT IncidentLouisville cityscape.

f11photo // Shutterstock

12. Kentucky

– People affected per 10,000 residents: 140.3
– Breaches reported: 3
– Most common type of breach: Hacking/IT IncidentChicago neighborhood buildings and city skyline on sunny autumn day.

marchello74 // Shutterstock

11. Illinois

– People affected per 10,000 residents: 188.5
– Breaches reported: 21
– Most common type of breach: Hacking/IT IncidentView of Missoula from Mount Sentinel.

Jon Bilous // Shutterstock

10. Montana

– People affected per 10,000 residents: 196.1
– Breaches reported: 2
– Most common type of breach: Hacking/IT IncidentPark and skyscrapers in downtown Detroit.

Gerald Bernard // Shutterstock

9. Michigan

– People affected per 10,000 residents: 208.6
– Breaches reported: 21
– Most common type of breach: Hacking/IT IncidentScenic view of Phoenix.

Gregory E. Clifford // Shutterstock

8. Arizona

– People affected per 10,000 residents: 213.2
– Breaches reported: 9
– Most common type of breach: Hacking/IT IncidentPennsylvania State Capitol building.

Real Window Creative // Shutterstock

7. Pennsylvania

– People affected per 10,000 residents: 232.8
– Breaches reported: 27
– Most common type of breach: Hacking/IT IncidentIndianapolis skyline seen from canal walkway.

KYPhua // Shutterstock

6. Indiana

– People affected per 10,000 residents: 306.1
– Breaches reported: 14
– Most common type of breach: Hacking/IT IncidentBoston skyline with river.

lunamarina // Shutterstock

5. Massachusetts

– People affected per 10,000 residents: 335.5
– Breaches reported: 13
– Most common type of breach: Hacking/IT IncidentDenver cityscape.

Studio 1One // Shutterstock

4. Colorado

– People affected per 10,000 residents: 395.8
– Breaches reported: 9
– Most common type of breach: Hacking/IT IncidentAerial view of Grand Forks.

Jacob Boomsma // Shutterstock

3. North Dakota

– People affected per 10,000 residents: 655.2
– Breaches reported: 1
– Most common type of breach: Hacking/IT IncidentAerial view of Morgantown.

Canva

2. West Virginia

– People affected per 10,000 residents: 703.9
– Breaches reported: 7
– Most common type of breach: Hacking/IT IncidentMilwaukee cityscape with Art Museum with the Northwestern Mutual building.

Tony Savino // Shutterstock

1. Wisconsin

– People affected per 10,000 residents: 743.2
– Breaches reported: 9
– Most common type of breach: Hacking/IT Incident

Data reporting by Dom DiFurio. Story editing by Jeff Inglis. Copy editing by Tim Bruns. Photo selection by Elizabeth Ciano.

This story originally appeared on Drata and was produced and distributed in partnership with Stacker Studio.