Attack surface

Where does breached information sit, and which breach types go with which systems?

Network server and email are where breached information sits most often: 66% and 22% of reports list them, against 5% for paper and film, 5% for EHR, 2% for laptops and portable devices. The biggest shift is network server, up from 58% in 2022 to 71% in 2026. Unauthorized Access/Disclosure is 4.9× as common as chance would predict for paper/films breaches (152 reports against 31 expected). The most under-represented pairing is Hacking/IT Incident with paper/films (0 reports against 160 expected).

What this means for you

Email is a front door in 22% of reports. Treat the mailbox as a system holding ePHI: phishing-resistant MFA, retention limits and filtering.

Do this next

Harden email as a clinical system

This chapter's program actions come with a subscription

Lessons from resolved cases

Start free and set your program

The five front doors

Where breached information sits

Share of reports listing each location, by year, on one shared scale. OCR lets a report list several locations, so shares can add to more than 100%. Click a door to narrow the whole chapter to it.

Share of reports by location of breached information

Network server leads at 66% of reports, up from 58% in 2022.

Table view


2022	58%	24%	9%	4%	7%
2023	72%	18%	3%	1%	6%
2024	66%	23%	4%	2%	5%
2025	64%	24%	4%	2%	5%
2026	71%	21%	6%	1%	4%

How this is calculated

For each year, the number of reports listing the location divided by all reports that year. Laptops and portable devices combine OCR's Laptop and Other Portable Electronic Device categories. Years with fewer than 20 matching reports are left out of the lines and of the change figures (▲▼, first usable year to last).

Subscriber feature · $5 a month or $50 a year

Read the rest of Chapter 2: Attack surface

The findings, every chart with drill-down to the reports behind it, and what to do about it, recalculated for any state, entity type or year range you choose. Unlock all 14 chapters with a subscription.

Which breach types strike which systems
The full list, ranked
What this means for your program: 3 key points
4 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Harden email as a clinical system”
Exam angle for 5 CISSP, CISM and CISA domains, with a study prompt
2,853 lessons from resolved OCR cases filed under this chapter

Start free Or subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works