Loading story…
Authorized security assessments at hospitals uncovered serious weaknesses that allowed a red teamer to access restricted patient information through both physical and network paths. By posing as a new staff member, wearing scrubs, using a fake badge, and building rapport with a nurse by complaining about a real doctor, the tester was allowed past an electronic lock and a human gatekeeper into a medical records room, where he retrieved a target patient file and demonstrated how easily trust could override access controls.
A separate assessment found guest Wi-Fi effectively shared exposure with critical medical systems on VLAN 1, leaving devices including MRI machines visible from less trusted networks and transmitting sensitive patient data without encryption. The findings indicate that some healthcare environments continue to prioritize operational speed, uptime, and data flow over stronger security hygiene, increasing the risk of unauthorized access to restricted areas and private medical records.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
In another hospital assessment, Schloss found that guest Wi-Fi and critical medical systems were effectively exposed together on VLAN 1. This allowed visibility into unencrypted sensitive data from devices including MRI machines, highlighting poor network segmentation.
During an authorized hospital security assessment, red teamer Dahvid Schloss bypassed an electronic lock and a human gatekeeper by posing as a new staff member, using a fake badge, wearing scrubs, and building rapport with a nurse. He was then allowed into the medical records room and retrieved a target physical patient file, demonstrating exposure of private records through social engineering.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Health and Human Services **Office of Inspector General (HHS-OIG)** published an audit of an unnamed **large Southeastern U.S. hospital** (more than 300 beds) identifying security weaknesses in **four internet-accessible web applications** that could be used as vectors for initial access and could hinder timely breach detection if not remediated. The review assessed whether the hospital’s controls could prevent and detect cyberattacks, maintain **continuity of patient care**, and protect **Medicare enrollee data**; the hospital is part of a broader provider network that shares protected health information for treatment, payment, and healthcare operations. According to reporting on the audit, the hospital had adopted the **HITRUST Common Security Framework (CSF) v9.4** and maintained HIPAA-required administrative, physical, and technical safeguards, and OIG evaluated policies/procedures (including data protection, data loss prevention, network management, and incident response) and interviewed staff. OIG also performed **penetration testing and external vulnerability assessments**, finding that while controls detected most simulated attacks, **web-application weaknesses remained** that could be exploited; the coverage emphasized that similar issues may be present across other U.S. hospitals with comparable internet-facing application exposure.
Jun 29, 2026
Healthcare organizations remain under sustained cyber pressure, with **764 incidents reported in 2025** versus 749 the previous year, according to French health-sector reporting cited by *ZDNet*. A national survey of healthcare executives found that **15% of facilities** said they had experienced a cyber incident causing disruption since 2022, while leadership concerns in a crisis center on **continuity of care**, financial impact, and staff working conditions. The reporting indicates cyber risk is now treated as a governance issue rather than only a technical one, but resource constraints and the need to strengthen hospital information systems remain major obstacles. Germany’s **BSI** separately warned that software security in the healthcare sector is still inadequate after testing standard configurations of several medical and practice-management applications. In that review, **three of four** examined practice management systems contained chains of weaknesses that could have enabled **internet-based attacks**, including the use of outdated encryption algorithms; vendors were notified and reportedly remediated the issues. A separate *ZDNet* article about manipulation of online payment flows at Spanish hotels concerns a **different incident** in the payment sector and is not part of the healthcare story.
Jun 29, 2026
A recent security posture report on the biotech sector has revealed that attackers can access sensitive health data with minimal effort, often requiring less than two hours per company to uncover critical vulnerabilities. Researchers found that APIs were the most prevalent weakness, accounting for 34% of identified issues, with many endpoints exposing personal information such as patient IDs, genetic reports, and partner data without authentication. Publicly accessible developer documentation, including Swagger and GraphQL introspection, allowed for comprehensive mapping of API surfaces, further increasing the risk of unauthorized access. More than half of the companies examined leaked internal system details through verbose error messages, exposed configuration files, or non-minified JavaScript, which included sensitive information like usernames, user IDs, file paths, and backend framework details. In some instances, hardcoded secrets such as API keys and private tokens were visible in frontend code, and verbose errors revealed stack traces and server internals, making it easier for attackers to identify exploitable weaknesses. Additionally, around 36% of companies had corporate credentials discoverable through public sources, often due to prior third-party breaches and stealer logs, highlighting the widespread issue of credential reuse. These exposed credentials, sometimes numbering 15 or more per company, could facilitate credential stuffing or account takeover attempts. The broader healthcare sector continues to face significant challenges, with breaches costing organizations an average of $398 per exposed record and $7.42 million per incident, the highest across all industries. The number of healthcare providers reporting losses over $200,000 quadrupled between 2024 and 2025, and 12% of providers suffered losses exceeding $500,000, double the average across all industries. The largest contributors to breach costs include detection and escalation, lost business, and post-breach responses, with many organizations raising prices to offset these expenses. Financial gain remains the primary motive for attackers in 90% of healthcare breaches, but espionage is increasingly significant, accounting for 16% of cases, partly due to geopolitical tensions such as the Russia-Ukraine war. Nearly half of healthcare organizations have experienced at least one cybersecurity incident in the past year, underscoring the sector's vulnerability. In 2024 alone, there were 1,710 reported data breach incidents in healthcare, with 1,542 confirmed cases compromising data integrity, confidentiality, or availability. The combination of technical weaknesses in biotech platforms and the high value of healthcare data continues to make the sector a prime target for cybercriminals. The findings highlight the urgent need for improved security fundamentals, including better API protection, credential management, and internal system hardening. Without significant improvements, healthcare and biotech organizations will remain at high risk for data breaches and associated financial and reputational damage. The report serves as a call to action for the industry to address these persistent vulnerabilities and adopt more robust cybersecurity practices. Proactive measures are essential to protect sensitive patient data and maintain trust in healthcare and biotech services. The ongoing trend of increasing breach frequency and cost demonstrates that current security measures are insufficient to counter evolving threats. Organizations must prioritize security at every level, from application development to employee credential management, to mitigate the risk of future incidents.
Jun 29, 2026