Business Associate breaches account for the largest percentage of breached patient records

The report summarizes the Bluesight 2025 Breach Barometer findings that business associates, while submitting a minority of breach reports, are responsible for the majority of breached healthcare records in 2023–2024. It calls out the Cl0p ransomware gang’s supply-chain attacks on file-transfer vendors (Accellion, GoAnywhere, MOVEit, Cleo), which used zero-day exploits to bypass encryption, exfiltrate millions of patient records, and publish data when extortion payments were not made, and urges stronger vendor security oversight and HIPAA considerations beyond encryption.