Healthcare cyber risk becomes business risk when access spreads

At a glance

What this is: This ColorTokens advisory argues that healthcare cyber incidents become business-risk events when attackers can move from initial access into operational systems, exposed devices, or core services.

Why it matters: For IAM, PAM, and security teams, the lesson is that authentication, segmentation, and reachability controls must be designed to stop compromised accounts and systems from turning into organisation-wide disruption.

By the numbers:

• AnMed temporarily closed 79 of its 106 facilities after a cyberattack disrupted computer systems, phone lines, and internet connectivity.
• The report cites exposure analysis showing roughly 3,900 Rockwell Automation PLCs reachable from the internet in the United States.
• Adobe ColdFusion CVE-2026-48282 carries a 10.0 severity score and could allow arbitrary code execution without user interaction.
• CVE-2026-35273 also carries a 10.0 score and could, .0 score and could allow an unauthenticated attacker with network access to compromise the platform.

👉 Read ColorTokens' threat advisory on healthcare disruption, critical software flaws, and exposed PLCs

Context

Healthcare cyber risk is not limited to data theft. When systems that route patients, coordinate staff, or support industrial and facility operations are disrupted, the incident becomes a business continuity and safety issue as much as a security issue. The primary problem in this article is blast radius, especially where compromised access can cross from one asset into many.

That matters to identity governance because compromised email accounts, administrative interfaces, exposed controllers, and vulnerable applications all become movement paths when access is too broad. In practice, the security question is whether IAM, PAM, segmentation, and monitoring can keep a single compromise from expanding into patient care disruption or operational downtime.

Key questions

Q: What breaks when a healthcare compromise can reach operational systems?

A: Once a compromise can move from a single account or application into patient-facing, clinical, or OT systems, the incident becomes a continuity problem. Organisations lose the ability to route work normally, staff may revert to manual processes, and recovery becomes slower because the attacker has access to more than one layer of the environment.

Q: Why do high-severity vulnerabilities still get missed in healthcare risk decisions?

A: Teams often over-focus on severity scores and underweight exposure, reachability, and business dependency. A flaw on an isolated system can be less urgent than a lower-scoring issue on an internet-facing platform that touches critical workflows. Practical prioritisation should combine technical severity with how far compromise can travel.

Q: What do security teams get wrong about OT exposure?

A: They often treat OT as separate from identity and access governance. In reality, exposed PLCs, remote admin paths, and vendor connections are access problems as much as equipment problems. If those paths are not tightly controlled, a remote attacker can interact directly with systems that support essential services.

Q: How should organisations contain a compromise before it becomes operational disruption?

A: Containment starts by limiting where compromised access can go. Put clinical, corporate, and OT services behind enforced trust boundaries, require secure remote access for administration, and monitor privileged sessions that cross domains. The goal is to stop a single foothold from becoming a multi-system outage.

Technical breakdown

Why healthcare breaches become operational events

Healthcare environments are highly interconnected, so a compromise rarely stays confined to one system. Business communications, scheduling, clinical support, and physical infrastructure often share trust relationships that were created for convenience, not containment. Once an attacker has a foothold through email, a web application, or an exposed device, the risk is not just data access. It is the ability to interrupt service delivery, force manual processes, or degrade visibility across multiple sites and functions. In this environment, resilience depends on reducing how far any one identity, system, or controller can reach.

Practical implication: map operational dependencies and cut trust paths that let one compromised asset affect patient-facing services.

How exposed applications turn severity scores into real risk

The article’s vulnerability examples show why CVSS alone is an incomplete decision tool. A 10.0 flaw matters most when the affected system is reachable, connected to sensitive workflows, or capable of launching code into adjacent services. In other words, exploitability, exposure, and business dependency determine the real threat. For identity teams, this also intersects with authentication and access paths, because unauthenticated or weakly controlled administrative surfaces can bypass normal governance. Prioritisation should therefore combine severity with reachability and the privilege a vulnerable platform can confer if compromised.

Practical implication: rank vulnerable systems by exposure and reachable privilege, not by severity score alone.

Why exposed PLCs are an access problem as much as an OT problem

Programmable logic controllers are designed to manage physical processes, but when they are internet-reachable they become remote attack surfaces. That creates an identity and access issue, not just an operations issue, because remote connectivity, vendor access, and administrative interfaces all need tight control. If attackers can interact with a PLC directly, they may alter states, reduce operator confidence, or force manual fallback. In practice, this is where microsegmentation, secure remote access, and asset inventory intersect. The core failure mode is unmanaged reachability, which turns operational equipment into a directly attackable service.

Practical implication: remove public exposure from PLCs and place all remote administration behind controlled access paths.

Threat narrative

Attacker objective: The attacker’s objective is to expand a single foothold into broad operational disruption or data exposure that forces the organisation to degrade services.

1. Entry occurs through a compromised email account, a vulnerable application, or an exposed controller that gives the attacker a foothold in the environment.
2. Escalation follows when the initial access can move into business systems, clinical workflows, or operational technology because segmentation and access boundaries are too permissive.
3. Impact is operational disruption, including interrupted communications, delayed appointments, manual workarounds, and potential interference with physical or essential services.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Internet Archive breach — unsecured GitLab authentication tokens exposed 31M Internet Archive accounts.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blast-radius control is now the central healthcare security problem. The article shows that the decisive question is not whether a system is vulnerable, but whether compromise can spread from one asset into patient care, communications, or physical operations. That is a governance problem across segmentation, authentication, and privileged access, not just a patching problem. Practitioners should treat containment as the primary outcome metric.

Healthcare identity controls fail when they assume a compromise stays digital and local. A stolen email account, an exposed controller, or an unguarded administrative surface can all become pathways into broader operational disruption. That is why identity governance must extend beyond user accounts to include administrative reach, vendor access, and service interfaces. The practical conclusion is to govern who can touch what, from where, and under which conditions.

Exposure ranking should replace severity-only thinking in operational environments. The article’s mix of CVEs and PLC exposure shows that a critical flaw in an isolated system is not equivalent to the same flaw on an internet-facing asset connected to essential services. This is where NIST-CSF, NIST SP 800-53, and microsegmentation thinking converge. Practitioners should prioritise control reach, not just technical severity.

Operational resilience depends on treating IT and OT as one risk continuum. Healthcare, enterprise software, and industrial controls now fail in linked ways, which means one compromised identity or application can create service disruption well beyond its original scope. That makes cross-domain governance essential, including access review, remote administration control, and incident containment. The practitioner takeaway is to govern the path of compromise, not just the asset inventory.

Management visibility is the named concept this advisory sharpens: unmanaged reachability. When devices, applications, and accounts remain reachable beyond their intended boundary, every other control becomes harder to enforce. This is especially relevant where NHI-style service access, vendor connectivity, or administrative automation exists alongside human access. Teams should reduce unintended reachability before they rely on detection to catch misuse.

From our research:

• 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, according to The State of Secrets Sprawl 2026.
• 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
• Next: Explore Guide to the Secret Sprawl Challenge for practical ways to reduce exposed credentials and limit blast radius.

What this signals

Unmanaged reachability is the pattern healthcare teams need to surface now. The article shows that a system can be technically patched and still be operationally dangerous if it remains too easy to reach from the wrong path. That makes segmentation, remote access governance, and inventory accuracy first-order programme controls rather than supporting hygiene.

A useful next step is to align vulnerability triage with business dependency and access path analysis, then validate whether critical services can still operate when one zone is isolated. Where identity and access control intersects with OT, teams should treat privileged session control and vendor access review as part of resilience planning, not just IAM administration. The same logic applies to service accounts and machine access that can traverse multiple domains.

For healthcare and adjacent critical services, the programme signal is clear: if an attacker can move from one identity, controller, or application into multiple service layers, the organisation has a containment problem. That is where operational resilience metrics should sit alongside traditional security metrics, with response plans tested against cross-domain failure rather than isolated compromise.

For practitioners

• Segment patient, business, and OT traffic by trust boundary Separate clinical systems, corporate systems, and operational technology so that compromise in one zone cannot directly reach the others. Use microsegmentation to enforce path restrictions and validate that critical services remain isolated during incident conditions.
• Prioritise exposure plus reachability in vulnerability triage Rank flaws by whether the affected system is internet-facing, reachable from privileged admin paths, or connected to sensitive workflows. Use this approach to avoid over-prioritising high CVSS issues that sit behind strong containment while missing exposed systems with limited apparent severity.
• Lock down administrative and vendor access paths Require secure remote access methods for controllers, support tools, and sensitive applications, and remove public administrative interfaces wherever possible. This includes hardening authentication controls and logging all privileged sessions that can reach operational systems.
• Inventory OT assets and exposed controllers continuously Maintain an accurate inventory of PLCs, controllers, and connected services so exposure does not persist unnoticed. Reconcile the inventory against internet exposure and vendor advisories, then close any paths that allow direct interaction with critical devices.

Key takeaways

• Healthcare cyber incidents become business-risk events when the attacker can move from a single foothold into care delivery, communications, or OT.
• Exposure and reachability explain more real-world risk than severity scores alone, especially for internet-facing applications and controllers.
• Containment through segmentation, secure remote access, and privileged access control is the control set that limits operational disruption.

Key terms

• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Reachability analysis: Reachability analysis checks whether a vulnerability can actually be exploited in the application’s real code paths and dependency graph. It helps teams distinguish theoretical findings from issues that an attacker can reach, which makes prioritisation far more accurate for both AppSec and identity risk management.

What's in the full article

ColorTokens' full threat advisory covers the operational detail this post intentionally leaves for the source:

• Specific breach notes on AnMed, Operation PAR, Eyemart Express, Vanderbilt Health, and Heart Care Centers of Illinois.
• The advisory’s vulnerability list across Adobe ColdFusion, Oracle PeopleSoft, Microsoft SharePoint, Active Directory Federation Services, Joomla, and BMC Control-M.
• Exposure analysis and prioritisation logic for internet-facing systems, connected applications, and operational technology.
• Recommended containment steps for network segmentation, secure remote access, and microsegmentation.

👉 ColorTokens' full advisory covers the breach details, vulnerability set, and exposed-system analysis behind the operational risk picture.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management in a format designed for practitioners building control frameworks. It is a fit for teams that need to connect identity governance to operational resilience and access containment.