Paubox

170 email-related healthcare breaches occured in 2025.

53% of email-related healthcare breaches occurred on Microsoft 365.

Microsoft 365 is adopted by approximately 79% of healthcare organizations.

16% of email-related healthcare breaches in 2025 involved business associates.

Approximately 3 million email addresses in the healthcare sector may be at risk of exposure to cyberattacks due to unverified email delivery practices.

Approximately 4.5% of outbound healthcare email connections were delivered to servers with expired or self-signed certificates.

43.3% of healthcare email breaches involved Microsoft 365.

IT leaders estimate only 5% of known phishing attacks are reported by healthcare employees to their security teams.

There was a 264% increased surge of ransomware attacks on healthcare organizations.

107 email-related HIPAA breaches were reported to the Department of Health and Human Services in just the first half of 2025.

The current pace of healthcare breaches in 2025 suggests the year is set to exceed 180 email breaches, which was the total reported last year.

In one enforcement case, a clinic was fined $25,000 for a single message that contained protected health information (PHI) and was sent to the wrong person without encryption

25% of healthcare organizations have not formally approved any staff use of AI in email.

69% of healthcare IT leaders feel pressured to adopt AI faster than they can secure it.

94% of healthcare organizations have begun updating security policies to address generative AI threats in email.

The largest single email breach, affecting United Seating and Mobility, exposed over half a million records.

The sharp rise in Microsoft 365 email breaches in healthcare represents a 21% increase year-over-year.

The Episource breach affected 5.4 million individuals

More than 80% of small healthcare practices expressed confidence in their current HIPAA compliance posture.

83% of small healthcare practices believe patient consent removes the need for encryption.

Nearly half of healthcare email breaches stem from Microsoft 365 alone.

4 out of 5 rural healthcare leaders say their infrastructure cannot support advanced email security.

Rural healthcare organisations trail urban ones by 22% in adopting AI-based threat detection.

6 out of 10 rural healthcare providers say their current secure email platform causes regular complaints and workflow delays.

53% of healthcare IT leaders cited lack of vendor support as the most common barrier to adopting secure, compliant email solutions.

54% of healthcare IT leaders cited implementation complexity as the most common barrier to adopting secure, compliant email solutions.

86% of healthcare IT leaders say their current email security tools create workflow friction, causing staff to bypass security processes.

Only 4% of known HIPAA email violations are reported to healthcare security teams.

60% of healthcare IT leaders reported email security breaches or security incidents last year.

60% of healthcare organizations surveyed experienced email-related security incidents last year that exposed sensitive patient data.

Stolen login credentials led to the most damaging email-related healthcare breaches in 2025, exposing more than 630,000 patient records.

Approximately 17% of healthcare email breaches were the result of phishing-driven mailbox takeovers.

Less than one-fifth of total healthcare email incidents involved identity abuse via stolen credentials, yet these remained the most damaging type of attack.

74% of breached healthcare organizations lacked effective DMARC enforcement (41% missing entirely, 33% monitor-only).

56% of breached healthcare organizations had permissive or missing SPF records (9% missing, 46% soft fail).

31% of breached Microsoft 365 healthcare organizations were classified as High Risk.

41% of breached healthcare organizations fell into a high-risk category based on their email configuration, up from 31% in 2024.

Proofpoint, Barracuda and Mimecast accounted for 19% of email healthcare breaches in 2025.

85% of healthcare IT leaders said they suspected staff were using unauthorized AI tools.

Only 26% of healthcare IT leaders reported having visibility into staff usage of unauthorized AI tools.

Barracuda, Mimecast, and Proofpoint account for 26.7% of healthcare email breaches in 2024.

1.1% of healthcare organizations analyzed had a 'Low Risk' email security posture.

68.8% of healthcare organizations analyzed had a 'Medium Risk' email security posture.

31.1% of healthcare organizations analyzed had a 'High Risk' email security posture.

16% of healthcare IT and compliance leaders admit compliance was never consulted before AI email tools were enabled.

75% of healthcare organizations say AI has added confusion, not clarity, to email compliance.

58% of healthcare organizations have not signed a BAA for an AI email tool so far.

Only 16% of healthcare organizations have trained most of their staff (75-100%) who have access to PHI on AI usage in email.

21% of respondents from healthcare organizations believe a Business Associate Agreement (BAA) isn’t required for an AI email assistant.

83% of healthcare IT and compliance leaders have raised concerns about AI security.