The $1 Million Deepfake: Why Hospitals Can't Wait

As AI-powered attacks continue to rise, Pindrop and Wakefield Research surveyed 122 U.S. security leaders at healthcare organizations to better understand how prepared they are to defend agains these threats. There are several implications for hospitals specifically.

Nearly one in four healthcare organizations hit by a deepfake attack has lost $1 million or more from a single incident.¹ Only 9% of healthcare security leaders say they have tools built specifically to catch these attacks.¹ For most hospitals, the phone channel hasn't received the same Zero Trust scrutiny as logins and networks, even though it's where deepfakes are actually attacking.

Deepfakes are already inside the hospital system

A deepfake is an AI-generated voice, video, or image convincing enough to pass for a real person in real time. In healthcare, 73% of security leaders report or suspect their organization has already encountered one.¹ More than 40% say they have faced IT help desk deepfakes and executive impersonations, and 28% have encountered deepfake job candidates.¹ 

These aren't hypothetical scenarios. In December 2025, the American Hospital Association issued a formal notice warning hospitals and health systems to brace for AI-generated audio and video used to impersonate trusted staff and executives, specifically to trigger credential resets and fraudulent fund transfers. Months later, in April 2026, the American Medical Association separately warned that deepfakes impersonating physicians are "not just scams" but a public health and safety issue, citing cases where synthetic audio and video misled patients and influenced clinical decisions.

Kettering Health's 2025 ransomware incident showed how these tactics compound each other in a hospital setting. After an attack took down systemwide IT and phone lines, patients and staff couldn't reach call center support. The attackers used that chaos as cover, impersonating Kettering Health staff to solicit credit card payments for medical expenses from confused patients. It took the health system weeks to fully restore normal operations.

This incident highlights how deepfake exposure runs in both directions: attackers impersonating the hospital to patients, and attackers impersonating patients or staff to the hospital. In 2025, 38% of Americans received a scam call impersonating one of their healthcare providers, a number that jumps to 53% among Gen Z patients.² 

A deepfake voice doesn't need to be perfect. A convincing voice, combined with social engineering tactics, can be enough to get a nurse, a help desk agent, or a patient to act. 

The bill doesn’t wait for budget approval

Healthcare has recorded the highest average breach cost of any industry for 13 consecutive years, at $6.64 million per breach. Deepfake-specific incidents track a similar pattern: roughly 1 in 4 affected healthcare organizations lost $1 million or more to a single deepfake attack,¹ and additional research found AI-driven attacks have surged ~14x since Q4 2026. Social engineering attacks that use IT or help desk impersonation and MFA fatigue, the same playbook behind most deepfake voice incidents, now take an average of 254 days to identify and contain once inside a healthcare organization.³

Consequences often compounded beyond the initial fraudulent interaction. Survey respondents reported: 47% faced a data breach, 44% encountered compliance risks, and 40% experienced follow-up cyberattacks such as ransomware.¹ What begins as an initial deepfake social engineering vector frequently serves as a gateway to broader operational paralysis, significant costs, and system-wide security failure.

Our survey reveals that 94% of security leaders say they're concerned their organization isn't prepared for a deepfake attack.¹ That concern isn't matched by investment. Fewer than 1 in 10 healthcare organizations have deployed a tool purpose-built to detect synthetic voices.¹ The fallback, knowledge-based authentication, is bypassed by fraudsters 50%+ of the time using stolen personal information, meaning most hospitals are relying on a check that deepfakes can beat with ease.

Boards won't act until it's personal, and that's a problem

Seventy percent of healthcare security leaders agree it will take a leader at their own organization being personally impersonated before deepfakes become a genuine boardroom priority.¹ Thirty percent go further, believing a single successful attack could put a company like theirs out of business.¹ The gap between what security teams see and what boards fund is a real vulnerability. Waiting for a headline-grade incident, like Kettering Health's, to justify the investment means absorbing the first seven-figure loss as the cost of getting leadership's attention.

Framing the risk in board-ready terms helps close that gap: this is an active, financially material threat, growing faster than most current defenses, that touches every function that talks to a patient or employee over the phone.

What hospital security leaders should do now

Three steps differentiate hospitals that are exposed from hospitals that are ready:

• Treat voice and video channels as part of Zero Trust. Verify identity on every high-risk call and remember, knowing the right answers doesn't mean the caller is who they say they are.
• Benchmark current deepfake defenses against peers, rather than assuming legacy tools like KBA and caller ID are sufficient.
• Quantify an exposure estimate, referencing incidents like Kettering Health's, to educate senior leaders about the risk before an incident forces the conversation.

Pindrop has spent more than 15 years defending the voice channel for Fortune 500 companies, and its detection models have been tested against real attacks, not just internal data. As deepfake threats extend from phone calls into video meetings, that same real-time verification is what lets hospital staff confirm who they're actually talking to, before a synthetic voice becomes a seven-figure problem.