Loading story…
The U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) published an audit of an unnamed large Southeastern U.S. hospital (more than 300 beds) identifying security weaknesses in four internet-accessible web applications that could be used as vectors for initial access and could hinder timely breach detection if not remediated. The review assessed whether the hospital’s controls could prevent and detect cyberattacks, maintain continuity of patient care, and protect Medicare enrollee data; the hospital is part of a broader provider network that shares protected health information for treatment, payment, and healthcare operations.
According to reporting on the audit, the hospital had adopted the HITRUST Common Security Framework (CSF) v9.4 and maintained HIPAA-required administrative, physical, and technical safeguards, and OIG evaluated policies/procedures (including data protection, data loss prevention, network management, and incident response) and interviewed staff. OIG also performed penetration testing and external vulnerability assessments, finding that while controls detected most simulated attacks, web-application weaknesses remained that could be exploited; the coverage emphasized that similar issues may be present across other U.S. hospitals with comparable internet-facing application exposure.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
HHS-OIG released its audit report warning that the hospital's vulnerabilities could serve as vectors for cyberattack and that the hospital would have difficulty detecting a breach unless defenses were strengthened. The report made four recommendations, including stronger authentication, periodic user internet activity reviews, evaluating the need for a web application firewall, and expanding application security testing methods; the hospital's name was withheld to reduce targeting risk.
During penetration testing and external vulnerability assessments, HHS-OIG found weaknesses that could enable initial access, including phishing-susceptible users, weak input validation, and an internet-facing application vulnerable to injection attacks. In a phishing simulation, 2,171 emails were sent, 108 users clicked the link, one user submitted credentials, and those credentials were used to access an account management application.
The HHS Office of Inspector General conducted an audit of an unnamed large hospital in the Southeastern United States, assessing four internet-facing web applications and the hospital's cybersecurity controls using HITRUST CSF v9.4 as the primary framework. The review focused on whether the hospital could prevent unauthorized intrusion, protect patient data, and maintain continuity of care during a cyber incident.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Healthcare organizations remain under sustained cyber pressure, with **764 incidents reported in 2025** versus 749 the previous year, according to French health-sector reporting cited by *ZDNet*. A national survey of healthcare executives found that **15% of facilities** said they had experienced a cyber incident causing disruption since 2022, while leadership concerns in a crisis center on **continuity of care**, financial impact, and staff working conditions. The reporting indicates cyber risk is now treated as a governance issue rather than only a technical one, but resource constraints and the need to strengthen hospital information systems remain major obstacles. Germany’s **BSI** separately warned that software security in the healthcare sector is still inadequate after testing standard configurations of several medical and practice-management applications. In that review, **three of four** examined practice management systems contained chains of weaknesses that could have enabled **internet-based attacks**, including the use of outdated encryption algorithms; vendors were notified and reportedly remediated the issues. A separate *ZDNet* article about manipulation of online payment flows at Spanish hotels concerns a **different incident** in the payment sector and is not part of the healthcare story.
Jun 29, 2026
Authorized security assessments at hospitals uncovered serious weaknesses that allowed a red teamer to access restricted patient information through both physical and network paths. By posing as a new staff member, wearing scrubs, using a fake badge, and building rapport with a nurse by complaining about a real doctor, the tester was allowed past an electronic lock and a human gatekeeper into a medical records room, where he retrieved a target patient file and demonstrated how easily trust could override access controls. A separate assessment found guest Wi-Fi effectively shared exposure with critical medical systems on `VLAN 1`, leaving devices including MRI machines visible from less trusted networks and transmitting sensitive patient data without encryption. The findings indicate that some healthcare environments continue to prioritize operational speed, uptime, and data flow over stronger security hygiene, increasing the risk of unauthorized access to restricted areas and private medical records.
Jul 24, 2026
The US Department of Health and Human Services (**HHS**) is increasing scrutiny of **third-party service provider** cybersecurity in the healthcare sector following the 2024 **Change Healthcare** cyberattack, which HHS officials describe as having threatened the “liquidity” of the broader healthcare system. HHS’s Charlee Hess (Administration for Strategy Preparedness and Response) said the incident exposed previously underappreciated systemic risk from external vendors that can have outsized sector-wide impact, and noted HHS is working through a methodology—alongside industry—to identify where those critical third-party dependencies and risk concentrations exist. Reporting reiterated that the Change Healthcare intrusion began with attackers exploiting the lack of **multi-factor authentication (MFA)** on a remote access portal and ultimately exposed data affecting roughly **190 million** people. The breach has also driven broader government and industry responses, including proposals for mandatory cybersecurity requirements on hospitals (which healthcare organizations have opposed as burdensome, arguing the Change Healthcare compromise originated with an external vendor) and remediation actions by **UnitedHealth Group** (Change Healthcare’s parent) to “start over” on aspects of its systems and technology environment.
Jun 29, 2026