Lessons from the 2026 Healthcare Cyber Report
Nearly every healthcare organization was attacked last year. The device most of them forgot to protect may be sitting in your hallway.
Industry Insight · Cybersecurity
November 2026
| 97% Hit by at least one attack | 51 Average attacks per organization | $4.2M Average cost of the costliest attack |
The Wake-Up Call
What a 97% Attack Rate Means for Secure Printing in Canada
Ninety-seven percent. That's how many healthcare organizations were hit by at least one cyberattack in the past 12 months. Not most. Nearly all. For leaders weighing secure printing solutions in Canada, that number deserves a closer look.
That number comes from independent research: the 2026 Cyber Insecurity in Healthcare report, published in October 2026 by cybersecurity company Proofpoint and the Ponemon Institute, a well-known privacy and security research firm. The study surveyed 705 IT and security practitioners at U.S. healthcare organizations.
In this article, we break down what the research found and what it means for your organization. The lessons travel north without a passport. For any Canadian organization that handles sensitive information, it's a strong reason to take a fresh look at how your printers are secured, and at every other device on your network that quietly touches your data.
2026 Cyber Insecurity in Healthcare: The Cost and Impact on Patient Safety and Care
Proofpoint & Ponemon Institute · October 2026
The volume alone is hard to ignore. Organizations in the study faced an average of 51 attacks over the year, up from 43 the year before. The single most expensive attack cost an average of $4.2 million (USD), a jump of nearly 8%. And when ransomware hit, 31% of organizations paid, with the costliest ransom payments averaging $1.1 million. Those are budget-breaking numbers for any organization, whatever its size.
The part that stays with you, though, isn't the money. Of the organizations that were attacked, 74% said patient care was disrupted. Among those, more than half reported increased complications from medical procedures, longer patient stays, and delays in tests and procedures. For organizations where data loss disrupted care, 56% reported increased mortality rates. These aren't IT metrics anymore. They're human outcomes.
Canada has had its own reminders, too.
Ontario hospitals have dealt with high-profile ransomware attacks in recent years that delayed care and exposed patient information, and healthcare is simply the early warning. Law firms, municipalities, schools, insurers, and manufacturers hold the same kind of confidential data, run on the same kinds of networks, and face the same attackers.
The Overlooked Endpoint
Why Printers Are the Blind Spot in Most Secure Printing Strategies
When most of us picture a cyberattack, we picture a phishing email or a hacked cloud account. That's fair. The report points to cloud and account compromise, ransomware, supply chain attacks, and business email compromise as the four big threat types. But attackers don't care which door they use. They look for the one nobody's watching, and in many offices that door is the multifunction printer down the hall.
A modern printer is really a networked computer. It has an operating system, firmware that needs updates, and often a hard drive that keeps copies of what's been scanned, copied, or printed. It may store email credentials for scan-to-email and connect to your user directory. Yet printers are often set up once and forgotten. They keep default admin passwords and run firmware that's years out of date. And they sit in a grey zone where IT assumes facilities owns them, and facilities assumes IT does.
Think about what moves through a healthcare printer on an ordinary Tuesday. Intake forms, lab results, referrals, prescriptions, and insurance details. Now swap in your own industry: contracts, payroll, tenders, student records. The report found that employee negligence is the leading cause of data loss, and a lot of everyday negligence happens at the printer. A confidential page is left in the tray. A scan goes to the wrong address.
An old device leaves the building with a full hard drive. None of it feels like a cyber incident until it is one.
The Report at a Glance
2026 Cyber Insecurity in Healthcare
Proofpoint & Ponemon Institute · 705 U.S. healthcare IT and security practitioners · October 2026
97% experienced at least one cyberattack in the past 12 months
51 attacks per organization on average, up from 43 in 2025
74% of attacked organizations reported disruption to patient care
53% of those saw increased complications from procedures; 52% saw longer stays and 52% saw test and procedure delays
21 data loss or exfiltration incidents involving sensitive health information per organization, on average, over two years
$4.2M average cost of the most expensive attack (USD)
31% of ransomware victims paid; the costliest ransoms averaged $1.1M
Where to Look First
Five Secure Printing Gaps Hiding in Plain Sight
The good news is that most print security gaps are simple to close once you know where they are. Here's where we suggest you start, whether you run a clinic, a law firm or a 500-person office.
1. Default passwords and open admin panels
Many printers ship with a factory admin password that's printed in the manual, and anyone can find the manual online. If no one changed it, anyone on your network can reach the device settings, redirect scans or turn off logging. Changing it takes minutes. It's one of the highest-value fixes you can make.
2. Firmware that never gets updated
Printer manufacturers release security patches just like Microsoft and Apple do. But printers rarely make it onto the patch schedule. An unpatched device is an open invitation, and it can give an attacker a quiet foothold to move across the rest of your network.
3. Data sitting on device hard drives
Every scan and copy can leave a trace on internal storage. Without encryption and a certified wipe at the end of a lease, that data walks out the door with the machine. This is one of the most overlooked risks in any secure printing plan.
4. Documents left in the output tray
The simplest data breach in the world is a sensitive page that nobody picked up. Secure release (sometimes called pull printing) holds each job until the person who sent it badges in or enters a PIN at the device. Nothing prints to an empty room.
5. Unmonitored scan-to-email and scan-to-cloud
Scanning workflows are convenient, and they're also a direct path for confidential files to land in the wrong inbox or an unapproved cloud folder. Locking down destinations, using address books instead of free-typed emails, and logging activity all help you see where your documents actually go.
The Bigger Network
Secure Printing Solutions Work Best Alongside Managed Devices
Printers are one piece of a bigger picture. Every laptop and desktop that sends a print job is an endpoint too, and ransomware loves to spread from one unpatched machine to the next. That's why secure printing works best when it's part of a wider device strategy. That strategy should cover patching, encryption, endpoint protection and a clear plan for retiring old hardware safely.
This is where managed device solutions in Canada earn their keep. When someone is responsible for keeping every PC current, monitored and properly wiped at end of life, a lot of the gaps attackers rely on simply close. Pair that with managed print solutions that treat each printer as a secured endpoint, and you've removed two of the easiest ways in.
There's also a quieter win in printing less.
Every sensitive document that lives in a secure digital system instead of on paper is one less page that can be left behind, misfiled or lost. Digital document management doesn't replace good security, but it shrinks the number of places your data can leak from. That matters most in industries where one misplaced page can turn into a privacy breach.
Looking Ahead
Building a Secure Printing Plan Your Team Can Actually Run
You don't need a massive budget to make real progress. Start with an inventory: how many printers and multifunction devices do you have, where are they, and who owns them? Then set a baseline for each one: changed admin credentials, current firmware, encrypted storage and secure release for sensitive departments. Finally, make it ongoing, with monitoring, a regular update schedule and a documented wipe process when devices are retired.
That's the approach we take with organizations across Ontario and Canada, from hospitals and law firms to municipalities and growing businesses. After more than 30 years and 7,500+ clients, we've learned that the best security plans aren't the most complicated ones. They're the ones your team can actually keep up with week after week, without adding to an already full IT workload.
Healthcare’s numbers are a warning, and a rare advantage. They show leaders exactly where the pressure points are, before an attack forces the decision. For a CEO or director, the real question isn’t whether IT is busy. It’s whether every device that touches your data is accounted for. So here’s one worth adding to your next leadership meeting: when did anyone last confirm that your printers are secure?
Source: Proofpoint and Ponemon Institute, 2026 Cyber Insecurity in Healthcare: The Cost and Impact on Patient Safety and Care (October 2026). Dollar figures are in U.S. dollars.
Let's Talk About Secure Printing for Your Organization
In one strategic conversation, we’ll give you a clear view of every printer and device on your network, the risks that matter most to your business, and a practical roadmap to close them, without adding to your team’s workload.
Book a Strategy Conversation with QRX TodaySecure Printing Cybersecurity Healthcare IT Managed Print