Phished credentials drive the largest healthcare breaches

At a glance

What this is: This is a healthcare breach evidence review showing that phished or stolen credentials and vendor exposure dominate the largest loss events.

Why it matters: It matters because IAM, PAM, and third-party access controls now determine whether attackers can turn a login into a major breach.

By the numbers:

• When investigators can name the attack vector, 88% of breached healthcare records trace to a phished or stolen credential.
• Crayonic analysed 7,834 breach filings in the US federal register.
• Crayonic's review covered 1.05 billion records lost in the US federal register from 2009 to July 2026.

Context

Healthcare breach data keeps pointing to the same governance failure: credentials, not deep technical exploitation, are the fastest path to large-scale loss. In this review, the primary question is how far existing identity controls would have reduced breach impact if phished or stolen credentials had been blocked and vendor access had been constrained.

The article treats healthcare breach filings as a control signal for identity programmes. That framing is important for IAM, PAM, and third-party governance because the largest incidents are not only about intrusion volume, but about which identities can be abused once an attacker gets in.

Key questions

Q: What fails when healthcare systems still trust phished credentials?

A: The failure is not only the stolen password itself, but the assumption that authenticated access is therefore legitimate. If a remote portal or application accepts a phished credential, the attacker inherits the user’s trust boundary and can often reach records, workflows, or support tools that were never meant to be exposed through a single login.

Q: Why do vendor incidents create outsized breach impact in healthcare?

A: Third-party access often carries broad, durable reach into production systems, so a compromise can spread through trusted connections rather than noisy exploitation. When supplier accounts are not tightly scoped or revoked on time, an attacker can use the vendor relationship itself as a force multiplier for record theft and operational disruption.

Q: What are the signs that identity controls are not containing breach blast radius?

A: Warning signs include remote-access accounts with broad data reach, vendors that retain standing access after projects end, and breach reports that repeatedly start with valid credentials. When those patterns appear together, the organisation is measuring login control but not containment, which means compromise can still become large-scale loss.

Q: How should healthcare teams prioritise credential defence versus server patching?

A: Both matter, but the article shows that credential abuse is tied to the biggest losses while unpatched systems more often produce smaller incidents. That means teams should prioritise the identities and access paths that can reach high-value records first, then use patching to reduce the broader intrusion surface.

Technical breakdown

Why phished credentials still dominate healthcare breach entry

In healthcare breach reporting, the initial foothold often comes from a valid login rather than malware-driven exploitation. A phished or stolen credential bypasses perimeter assumptions because the attacker is authenticated before the breach really begins. That makes identity assurance, phishing-resistant authentication, and remote-access control more decisive than purely network-based defences. The article’s evidence also explains why many cases remain hard to classify: if investigators cannot name the cause, the breach may still have started with credential abuse. Practical implication: treat authentication strength as a breach-prevention control, not a user-experience layer.

Practical implication: prioritise phishing-resistant authentication and reduce the number of remotely usable credentials.

Why vendor access expands the blast radius

Vendor incidents become dangerous when third-party access persists beyond the business need that justified it. Once an external account, token, or remote session can reach sensitive systems, the attacker inherits the supplier’s access scope and can move laterally through trusted pathways. That is a lifecycle problem, not just an initial-access problem. The article’s note that six of the ten largest breaches were vendor incidents shows how third-party identity governance can convert a contained compromise into a large-scale event. Practical implication: third-party access needs lifecycle control, not just onboarding approval.

Practical implication: enforce strict third-party access lifecycle controls and remove standing access paths that outlive the engagement.

Identity blast radius is the real breach multiplier

The most damaging incidents are not always the most frequent ones. The review shows that breach frequency has stayed flat since 2021 while the median breach tripled in size, which means the organisation’s exposure is concentrating rather than dispersing. That pattern points to poor containment around privileged identities, remote access, and high-value datasets. In practice, the question is no longer whether attackers can get in, but how much they can reach once they do. Practical implication: measure access scope as blast radius, not just authentication success rate.

Practical implication: map privileged and third-party access against blast radius so you can shrink the reachable asset set.

Threat narrative

Attacker objective: The attacker wants to convert a legitimate login into large-scale access to regulated healthcare records or vendor-connected systems.

1. Entry typically starts when an attacker uses a phished or stolen credential to sign in through a remote-access portal or other trusted access path.
2. Escalation follows when that authenticated session reaches systems with broad access to healthcare records or supporting platforms.
3. Impact occurs when the attacker logs into the big data store and exfiltrates records at scale, turning a valid account into a breach amplifier.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phished credentials are still the cleanest path to catastrophic healthcare loss. The article’s core finding is not that attackers are especially sophisticated, but that valid authentication remains the easiest way through the door. When a remote-access portal accepts a stolen identity, network controls and data-store hardening arrive too late. The practitioner conclusion is blunt: identity assurance must be treated as a front-line breach prevention control.

Vendor access without lifecycle offboarding creates an identity blast radius problem. Six of the ten largest breaches being vendor incidents shows that the issue is not simply third-party risk in the abstract. It is the persistence of external access beyond the business need that justified it. That is a governance failure in third-party account lifecycle, and it turns supplier trust into an enterprise-scale exposure.

Healthcare breach trends now reward containment over counting incidents. The review says breach frequency has been flat since 2021 while the median breach has tripled in size. That shift means the dangerous question is no longer how often attackers try, but how much they can reach once a trusted identity is compromised. Practitioners should measure reachable privilege and data adjacency, not just control coverage.

Blast-radius control is the named concept this data makes unavoidable. The article shows that the biggest losses come when authenticated access can traverse from a login to the highest-value record systems. That is a governance model built on implicit trust in credentials and vendors, and it fails when those identities become attacker-controlled. The implication is that healthcare IAM and PAM programmes must be judged by how much they constrain damage after authentication, not only by login success rates.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Third-Party, B2B and Contractor Access Guide

What this signals

Blast-radius control is now a healthcare identity metric, not just a breach afterthought. If attackers can turn one credential into record-scale access, the control objective shifts from preventing every login attempt to constraining what any single login can reach. That means third-party account scope, remote-access entitlements, and privileged pathways deserve the same scrutiny as authentication strength.

Healthcare teams should assume that vendor trust is part of the attack surface. The article’s data makes a strong case for lifecycle governance around supplier access, especially where support accounts, tokens, or delegated access can outlive the business need that created them.

For practitioners

• Tighten phishing-resistant authentication for remote access Require stronger authentication for portals that can reach protected health information, especially any remote-access path that currently accepts reusable passwords or weak MFA.
• Rebuild third-party access governance Inventory vendor accounts, tokens, and support pathways, then remove standing access that remains active after the business need ends.
• Reduce reachable blast radius for privileged identities Segment sensitive data paths so a single authenticated session cannot reach large record sets or administrative functions without additional controls.
• Track breach exposure by identity path Separate incidents caused by credentials, vendor access, and patched systems so you can see which control family is actually failing.

Key takeaways

• Healthcare breach patterns continue to show that valid credentials are the common path to major losses, not just isolated account abuse.
• The largest incidents are often vendor-driven, which means third-party access governance directly affects breach size and recovery burden.
• Teams that want to reduce impact need to shrink identity blast radius, not only harden passwords and patch servers.

Key terms

• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Third-Party NHI: Third-Party NHI is a non-human identity owned or operated by an external organization, partner, contractor, or supplier. It includes service accounts, API keys, certificates, tokens, and automated agents that access systems outside the primary enterprise boundary. Governance must cover issuance, scope, monitoring, revocation, and contractual accountability.
• Phishable Credential: A phishable credential is any login factor that can be tricked, copied, or relayed by an attacker, such as passwords, OTPs, SMS codes, or push approvals. These factors may improve security over a password alone, but they still depend on secret sharing and are vulnerable to interception or social engineering.
• Blast Radius Control: Blast radius control is the practice of limiting how far damage can spread when an identity, system, or workload is compromised. It uses segmentation, least privilege, isolation, and scoped credentials to contain impact. In identity security, it reduces lateral movement, privilege escalation, and data exposure after a breach or misuse.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.