Topic starter
24/06/2026 8:57 pm
TL;DR: Healthcare organizations reporting losses above $200,000 nearly quadrupled from 5% to 19% year over year, while 48% experienced at least one incident and 31% saw compromised user or admin accounts, according to Netwrix's 2025 Cybersecurity Trends Report. The findings show that identity-first defence is no longer optional when AI-accelerated phishing and privilege abuse are driving faster, costlier attacks.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “Healthcare Cyberattack Losses Above $200,000 Nearly Quadruple in 12 Months, Netwrix Survey Finds”.
By the numbers:
- Nearly half of healthcare organizations, 48%, experienced at least one cybersecurity incident over the past year.
- 31% of healthcare respondents said their organizations had incidents involving compromised user or admin accounts.
Key questions
Q: Why do compromised user and admin accounts increase healthcare breach costs so quickly?
A: Compromised user and admin accounts are expensive because they already sit close to sensitive records and operational systems.
Q: How should healthcare teams reduce the impact of AI-accelerated phishing?
A: Treat it as an identity control problem first.
Q: What are the signs that identity-first defence is not working in healthcare?
A: Repeated compromise of user or admin accounts, broad access to sensitive systems, and losses that keep moving into higher severity bands are the clearest warning signs.
Practitioner guidance
- Constrain administrative reach Map which user and admin accounts can touch clinical, financial, and patient-data systems, then remove any access that is not strictly required for role execution.
- Harden phishing-resistant access paths Prioritise stronger authentication for privileged users and high-risk access paths so stolen passwords do not become the primary control failure.
- Reduce standing privilege Identify accounts with persistent elevated rights, especially in healthcare operations, and replace broad standing access with narrower task-based entitlements.
Bottom line: Healthcare cyberattack losses are rising because valid identities now provide a fast route into systems that are hard to secure after compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:51 am
Healthcare loss is becoming an identity governance problem, not only a security event. The article shows that once a user or admin account is compromised, the cost can escalate quickly because those identities often bridge clinical systems, sensitive records, and operational processes. That makes account governance a resilience issue, not a narrow access-control question. Practitioners should read the loss figures as evidence that identity scope is driving business impact.
A few things that frame the scale:
- 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: Should healthcare organisations prioritise privilege reduction over more login controls?
A: They should do both, but privilege reduction often delivers the bigger risk reduction once phishing or stolen credentials are already in play. Login controls help prevent access, yet the severity of a breach is determined by what the account can reach after entry. That is why entitlement scope matters so much.
👉 Read our full editorial: Healthcare cyberattack losses expose the limits of identity-first defense