One Day Dark · Cyber Resilience Executive Dashboard · October 2026
Cyber Attack: Financial Disaster
What a ransomware outage costs your hospital for every day the EHR is down, who gets hurt, and how fast your organization can come back.
- 3.33 attacks a day, Q3 2026
- 17 days average US downtime
- 34 to 38% higher inpatient mortality
- 72% report care disruption
- $1.9M per dark day, US average
The argument
A ransomware attack is not an IT outage. It is a clinical and financial event that begins the moment the EHR goes dark, and every additional day of downtime is paid for in lost revenue, overtime, frozen cash and patient risk.
This dashboard turns current national evidence into a model leaders can run with their own numbers. Every default is sourced or labeled as an assumption, and every assumption is editable.
The threat in October 2026
3.33
ransomware attacks per day on the healthcare sector in Q3 2026, more than double the same quarter of 2025
Comparitech, reported by Security Magazine, Oct 15, 2026
51
average cyberattacks per US healthcare organization in the past year, up from 43; 97% had at least one
Proofpoint and Ponemon Institute, Oct 2026 (n=705)
$4.2M
average cost of an organization’s most expensive attack; disruption to operations ($1.39M) is the largest single cost
Proofpoint and Ponemon Institute, Oct 2026
72%
of organizations hit by ransomware reported disrupted patient care, up from 67%; 70% of those cited longer stays
Proofpoint and Ponemon Institute, Oct 2026
17 days
average downtime per ransomware attack on a US healthcare organization, at an estimated $1.9M per day
Comparitech, 654 attacks 2018 to 2024
$7.42M
average cost of a healthcare data breach, still the costliest industry; 279 days to identify and contain
IBM Cost of a Data Breach 2025
58%
of healthcare providers hit by ransomware recovered within a week in 2025, up from 21% in 2024
Sophos, State of Ransomware in Healthcare 2025
34 to 38%
increase in in-hospital mortality for patients already admitted when an attack begins; volume falls 17 to 24% in week one
Neprash, McGlave and Nikpay, AEJ: Economic Policy, 2026
Attacks per day on the healthcare sector
Daily rate derived from Comparitech period counts: 360 attacks in H2 2025 (184 days), 410 in H1 2026 (181 days), and the published Q3 2026 rate of 3.33 per day.
Author-derived rates from Comparitech counts. Includes healthcare providers and healthcare businesses worldwide.
Where cyberattacks reach the bedside
Share of organizations experiencing each attack type that reported disrupted patient care.
Proofpoint and Ponemon Institute, Cyber Insecurity in Healthcare 2026.
Why downtime runs long
The downtime cost model
Choose a profile closest to your organization, then replace the defaults with your own figures. The model prices five things: revenue lost while dark and during recovery, the labor premium of running on paper, incident response, the breach tail when data is stolen, and the cost of cash frozen in unbilled claims.
Each dark day costs
$398,369
Operating cost per day of downtime: lost margin, labor premium and frozen cash, before the fixed response and breach costs.
of operating margin consumed by one attack (ring fills at 12 months)
Total economic impact
$16,762,268
Share of annual revenue
4.19%
Cash frozen at peak
$13,134,247
Revenue at risk on day one
$323,288
The resilience dividend
$3,564,492
saved by recovering in 7 days instead of 17, the pace 58% of providers reached in 2025.
Where the money goes
Daily revenue lost, outage plus recovery
Red bars are dark days. Gray bars are the recovery ramp as volume returns. Values are net of outpatient recapture.
Cash frozen in unbilled claims
Revenue earned during downtime cannot be billed until systems return, then clears as the backlog is worked.
Calibration: at Ascension scale ($28.3B revenue, about 37 dark days) the engine freezes about $2.0B, against roughly $2.5B implied by Ascension’s reported rise in net AR days (46.7 to 78.4).
Board summary
Plain-language summary of the current scenario, ready to paste into a board or finance committee brief.
The patient ripple
The clinical cost of downtime falls on two groups: patients already in your beds when the screens go dark, and patients who arrive at the hospital down the road because you are on diversion. Both effects are now measured.
Patients in your beds when the screens go dark
150
Applying the published 34 to 38% relative increase to your baseline implies about 1.0 to 1.1 additional in-hospital deaths among this group.
Extra ED visits per day next door
+23
Extra ED visits over the outage
+385
Extra ambulance arrivals per day
+12
Median waiting room time
+47.6%
This is an illustrative application of published average effects, not a prediction for any individual hospital. The mortality estimate comes from Medicare fee-for-service patients already admitted on the day an attack was discovered (2016 to 2021). Neighbor effects come from two academic emergency departments next to a month-long ransomware attack in San Diego.
What happened at the hospital next door
Change at two unaffected San Diego emergency departments during a neighboring system’s month-long ransomware attack, compared with the four weeks before.
Dameff, Tully and Chan, JAMA Network Open, 2023. Stroke code activations rose from 59 to 103.
Inpatient admissions fall in week one
First-week decline in Medicare inpatient admissions at attacked hospitals, recovering within two to three weeks.
Neprash, McGlave, Rydberg and Henning-Smith, rural and urban event study, Medicare FFS 2016 to 2021.
Case files: four outages that changed the conversation
Each case shows a different way the dark day arrives: through a vendor, through a national system, through a regional network, and through a state’s only academic medical center.
February 2024
Change Healthcare: the vendor goes dark
- 192.7 million people affected, the largest US healthcare data breach on record
- $3.1 billion 2024 cost to UnitedHealth Group: $2.2B direct response plus $867M business disruption
- More than $9 billion in accelerated funding and interest-free loans to care providers
- A $22 million ransom was paid
Lesson: your downtime can start in someone else’s data center. Map every single point of failure in claims, eligibility, pharmacy and imaging.
May 2024
Ascension: a national system on paper
- EHR shut down systemwide; ambulance diversion and paused elective procedures; normal operations by mid-June
- Net days in accounts receivable rose from 46.7 to 78.4; days cash on hand fell from 211 to 194
- $1.8 billion fiscal 2024 operating loss, with much of the year’s improvement erased
- 5.6 million people affected; advance payments secured from commercial payers and CMS
Lesson: liquidity, not just revenue, is what an outage attacks. Pre-negotiate advance payment terms before you need them.
May 2025
Kettering Health: 41 days of silent access
- Attackers gained access April 9 and deployed ransomware May 20, 2025
- About 600 applications shut down, including Epic, MyChart and phone lines
- Epic core restored June 2; normal operations by June 10, about three weeks after the outage began
- 1,695,382 people affected; ransom declined; 44 lawsuits consolidated
Lesson: detection speed sets the size of the breach tail. Restoration is measured in applications, not in one EHR switch.
February 2026
UMMC: a state’s only academic medical center
- Epic, phones and email offline from February 19, 2026; hospitals and EDs stayed open on paper
- All 35 clinics closed statewide and elective procedures canceled; clinics reopened March 2
- The state’s only Level 1 trauma center; the statewide transfer coordination network was affected
- Clinics added extended hours and extra days to recapture canceled care
Lesson: when the regional safety net goes dark, every hospital in the state inherits the outage. Recapture capacity is part of recovery.
What earlier attacks cost provider organizations
Reported recovery cost or settlement, in millions of dollars. Change Healthcare ($3,100M) is excluded so the provider-scale bars remain readable.
Comparitech (CommonSpirit 2022, Scripps 2021, UHS 2020); Becker’s (Lehigh Valley proposed settlement, 2023 attack).
Downtime is getting shorter for the prepared
Share of attacked healthcare providers that fully recovered within one week.
Sophos, State of Ransomware in Healthcare 2024 and 2025. Median ransom paid fell to $150K in 2025.
Readiness 360
Rate your organization against the ten Essential HHS Healthcare and Public Health Cybersecurity Performance Goals, then against six downtime operations practices drawn from the case files. The proposed HIPAA Security Rule update has been delayed, but regulators and plaintiffs already use these goals as the yardstick for reasonable security.
Rate each item to build your score.
Essential goals profile
HHS Essential Cybersecurity Performance Goals
Mitigate known vulnerabilities
Critical and internet-facing vulnerabilities are patched on a defined, measured timeline.
Email security
Phishing protection, sender authentication and link and attachment controls are in place.
Multifactor authentication
MFA protects remote access, email, privileged accounts and cloud applications.
Basic cybersecurity training
Every workforce member completes training and phishing exercises each year.
Strong encryption
Sensitive data is encrypted in transit and at rest, including on mobile devices.
Revoke credentials for departing workforce
Access ends the day an employee, contractor, affiliate or volunteer leaves.
Basic incident planning and preparedness
A written, exercised incident response plan names roles and decision rights.
Unique credentials
No shared logins; unique credentials let you detect anomalous lateral movement.
Separate user and privileged accounts
Administrators use separate accounts for privileged work, never for email.
Vendor and supplier cybersecurity requirements
Contracts require security controls and breach notice from vendors.
Downtime operations practices
Offline, immutable backups restored in a test
A full restore of a clinical system has been timed within the last 12 months.
Downtime kits and paper workflows drilled
Units have practiced orders, medication administration and results on paper.
Alternate clearinghouse and paper charge capture
Claims can move through a second clearinghouse and charges can be captured manually.
Out-of-band communications
Phones, paging or radios work when the network, email and VoIP are down.
Regional diversion and transfer agreements
EMS, neighbors and transfer centers have a plan for your downtime and theirs.
Board-approved cyber incident command
Leaders know who decides diversion, shutdown, ransom and public statements.
Your top gaps
- Rate the items to see your gaps, lowest first.
Goals: HHS HPH Cybersecurity Performance Goals (January 2024), aligned to NIST CSF and the 405(d) Health Industry Cybersecurity Practices. Operations practices are author-defined from the Change Healthcare, Ascension, Kettering Health and UMMC case evidence. Ratings stay in this browser only.
The 5-P downtime playbook
Five steps that move an organization from hoping the EHR stays up to knowing how long it can operate without it. Each step ends with a measure the board can ask for.
Prepare
Treat cyber downtime as an enterprise risk with a named executive owner, not a line in the IT budget.
- Inventory every clinical and revenue system and its upstream vendors
- Run this cost model with finance and set a tolerable downtime target
- Pre-negotiate advance payment terms with major payers
- Confirm cyber insurance limits against the modeled total
Board measure: modeled cost per dark day and the approved recovery time target.
Protect
Close the gaps attackers use most: identity, email, unpatched systems and vendors.
- Reach Tested on all ten Essential performance goals
- Enforce MFA everywhere, starting with remote and privileged access
- Segment clinical networks so one compromise cannot reach everything
- Write security and breach notice terms into every vendor contract
Board measure: Readiness 360 score and the count of Essential goals at Tested.
Practice
Rehearse the dark day until paper operations are routine rather than heroic.
- Hold a quarterly downtime drill on at least one unit and one revenue process
- Time a full restore from offline, immutable backups
- Exercise diversion and transfers with EMS and the nearest hospitals
- Run an executive tabletop on the ransom and shutdown decisions
Board measure: measured restore time and drill completion by unit.
Perform
When the screens go dark, run an incident command that protects patients first and revenue second.
- Activate the emergency operations plan and out-of-band communications
- Decide diversion early and tell EMS and neighbors directly
- Prioritize time-sensitive care: chemotherapy, dialysis, stroke and trauma
- Capture charges on paper from hour one to protect cash later
Board measure: hours to incident command activation and to first patient communication.
Prove
Recovery is not over when the EHR returns. It is over when the backlog, the data and the trust are restored.
- Reconcile paper records and back-enter results with clinical review
- Work the billing backlog to pre-attack AR days
- Add capacity to recapture canceled appointments
- Publish an after-action review and fund the fixes
Board measure: days to return to baseline AR and percent of canceled care recaptured.
Methods
How the engine calculates
- Daily revenue = annual operating revenue / 365, split by inpatient, outpatient and emergency share.
- Revenue lost on each dark day = daily revenue in each setting × that setting’s loss rate. After restoration the loss declines in equal steps to zero across the recovery ramp.
- Recapture returns the chosen share of lost outpatient revenue, reflecting rescheduled clinic and elective care. Inpatient and emergency volume is assumed lost to other hospitals.
- Margin lost = net revenue lost × (1 − variable cost avoided). Labor is treated as fixed while dark because staff are still paid.
- Labor premium = daily labor cost × overtime and agency premium × (dark days + back-entry days). Daily labor = revenue × (1 − margin) × labor share / 365.
- Cash frozen at peak = revenue still earned while dark that cannot be billed until systems return. It clears in a straight line across the billing backlog period; its financing cost = average frozen balance × cost of capital × days frozen / 365.
- Total economic impact = margin lost + labor premium + incident response + breach tail (if data was stolen) + ransom + financing cost.
- Cost per dark day = (margin lost + labor premium + financing cost) / dark days. Fixed response and breach costs are excluded so the daily figure reflects duration alone.
- Resilience dividend = total at the current outage length minus total at 7 days, with every other input held constant.
Defaults and where they come from
| Input | Default | Basis |
|---|---|---|
| Operating margin | 2.5% | Kaufman Hall calendar YTD index, June 2026 |
| Labor share of expense | 60% | AHA Costs of Caring 2026 (includes purchased services) |
| Variable cost avoided | 21% | Supplies 13% and drugs 8% of hospital expense, AHA |
| Outage length | 17 days | Comparitech US healthcare average, 2018 to 2024 |
| Loss while dark | 20 / 40 / 25% | Within 19 to 41% setting range (Neprash et al.); assignment is an author assumption |
| Recovery ramp | 7 days | Volume recovered within 2 to 3 weeks of attack (Neprash et al.); ramp length is an author assumption |
| Outpatient recapture | 30% | Author assumption; UMMC added hours to recapture care |
| Overtime premium | 15% | Author assumption |
| Incident response | $2.57M community | Sophos 2024 mean healthcare recovery cost excluding ransom; other profiles scaled by the author |
| Breach tail | $7.42M community | IBM 2025 healthcare average; critical access and system profiles are author assumptions |
| Cost of capital | 7% | Author assumption |
| Mortality effect | +34 to 38% | Neprash, McGlave and Nikpay, AEJ: Economic Policy, 2026 |
| Neighbor surge | +15.1% census, +35.2% EMS | Dameff, Tully and Chan, JAMA Network Open, 2023 |
Limits: the model does not include cyber insurance recoveries, regulatory penalties, reputational volume loss, long-run litigation beyond the breach tail, or the cost of capital projects that follow an attack. Ransom payment is shown only as an input; nothing here recommends paying.
Sources
- Alger J. Healthcare ransomware attacks doubled since this time last year (Comparitech data). Security Magazine. October 15, 2026. securitymagazine.com
- Comparitech. Healthcare ransomware roundup: H1 2026 stats on attacks, ransoms, and data breaches. July 9, 2026. comparitech.com
- Proofpoint and Ponemon Institute. Cyber Insecurity in Healthcare 2026: The Cost and Impact on Patient Safety and Care. October 13, 2026. proofpoint.com
- Comparitech. US healthcare organizations lose $1.9 million per day to ransomware downtime. December 2024. comparitech.com
- IBM Cost of a Data Breach 2025, healthcare findings, as reported by HIPAA Journal. hipaajournal.com
- Sophos. The State of Ransomware in Healthcare 2025. October 2025. sophos.com
- Sophos. The State of Ransomware in Healthcare 2024. September 2024. sophos.com
- Neprash H, McGlave C, Nikpay S. The effects of ransomware attacks on hospitals and patients. American Economic Journal: Economic Policy. 2026. Working paper version: ssrn.com
- Neprash HT, McGlave CC, Rydberg K, Henning-Smith C. What happens to rural hospitals during a ransomware attack? Evidence from Medicare data. PubMed 38494590. pubmed.gov
- Dameff C, Tully J, Chan TC. Ransomware attack associated with disruptions at adjacent emergency departments in the US. JAMA Network Open. 2023;6(5):e2312270. doi.org
- UnitedHealth Group. Form 10-K for fiscal 2024, Change Healthcare cyberattack. sec.gov
- Reuters. Hack at UnitedHealth’s tech unit impacted 192.7 million. Business Insurance. businessinsurance.com
- Becker’s Hospital Review. Ascension’s losses from the cyberattack mount. September 2024. beckershospitalreview.com
- HIPAA Journal. Ascension ransomware attack affects 5.6 million patients. hipaajournal.com
- HIPAA Journal. Kettering Health ransomware attack: 1.7 million individuals affected. hipaajournal.com
- Paubox. Kettering Health ransomware hit 1.7M, confirmed year after Interlock breach. paubox.com
- Becker’s Hospital Review. University of Mississippi Medical Center to resume clinic operations after cyberattack. February 2026. beckershospitalreview.com
- Mississippi Free Press. University of Mississippi Medical Center hit by ransomware attack, closes clinics. February 2026. mississippifreepress.org
- OR Manager. Healthcare ransomware compromises millions of patient records, costs billions in downtime (Comparitech report). January 2025. ormanager.com
- Becker’s Hospital Review. Data breaches costing health systems millions (Lehigh Valley proposed settlement). beckershospitalreview.com
- HHS. Healthcare and Public Health Sector Cybersecurity Performance Goals. hhscyber.hhs.gov
- HIPAA Journal. Final rule implementing HIPAA Security Rule updates (status update July 2026). hipaajournal.com
- Advisory Board. Why hospital margins haven’t fully recovered (Kaufman Hall National Hospital Flash Report, June 2026). advisory.com
- American Hospital Association. Costs of Caring 2026. aha.org
- HIPAA Journal. 2025 Healthcare Data Breach Report. hipaajournal.com