Ransomware containment gaps are exposing healthcare and OT systems

At a glance

What this is: This is a ColorTokens analysis of recent healthcare, SaaS, and OT incidents showing that attackers are using initial access to spread laterally across flat environments.

Why it matters: It matters because IAM, PAM, NHI, and network teams all have to treat internal segmentation and third-party access boundaries as containment controls, not optional architecture.

Context

Ransomware containment is a governance problem as much as a detection problem. Once an attacker gets a foothold, flat internal environments let that access spread into systems that were never meant to trust one another, including healthcare platforms, OT consoles, and SaaS integrations. In this article, ColorTokens uses recent incidents to show how weak internal boundaries turn single-system compromise into multi-system exposure.

The identity angle is real even though the article sits in cyber_broad territory. Third-party CRM access, default HMI credentials, exposed admin panels, and token or account abuse all sit at the intersection of access governance and lateral movement control. For IAM and NHI teams, the core lesson is that internal trust must be bounded just as tightly as external authentication.

Key questions

Q: What breaks when ransomware can move freely inside a flat network?

A: A flat network turns one successful intrusion into an enterprise-wide event because the attacker can pivot from the first compromised system to many others. That breaks containment, recovery planning, and ransom decision-making at the same time. Security teams should assume that prevention will fail sometimes and design internal boundaries that stop one foothold from becoming broad disruption.

Q: Why do healthcare and OT environments need containment controls beyond patching?

A: Patching reduces exposure to known flaws, but it does not stop an attacker who is already inside. Healthcare and OT environments often include legacy devices, third-party tools, and tightly coupled systems that cannot be assumed safe once one component is compromised. Containment controls limit how far that compromise can spread.

Q: What are the signs that a segmentation strategy is not strong enough to contain breaches?

A: Warning signs include broad user-to-server access, unrestricted traffic between critical systems, reliance on unsupported applications, and a lack of staged policy testing before enforcement. If a breach can spread well beyond the initial entry point, segmentation is not doing enough. Strong programs limit movement, preserve operations, and make unauthorized paths difficult to use.

Q: Who is accountable for stopping lateral movement across cloud, healthcare, and OT systems?

A: Accountability usually sits across network security, IAM, application owners, and operational technology teams because the control is shared. Security leaders need clear ownership for internal trust boundaries, delegated access paths, and exception handling. Without that governance, flat environments persist even when everyone agrees they are risky.

Technical breakdown

How lateral movement turns one foothold into broad exposure

Lateral movement is the phase where an intruder uses the access gained at entry to reach additional systems, data stores, or administrative planes. In a flat network, the attacker does not need to defeat many separate trust boundaries. Once inside, weak segmentation and permissive east-west paths let the compromise expand from one host or account into broader operational impact. The article’s examples show this across healthcare, SaaS, and OT environments, where one exposed system can become a launchpad for the next.

Practical implication: segment internal zones so that initial access does not automatically become movement privilege.

Why third-party access and shared credentials raise containment risk

Third-party SaaS access, default HMI credentials, and exposed administrative interfaces all collapse the same control assumption: that authenticated access remains low-risk after login. In practice, shared or delegated access often carries broader reach than teams realise, especially when vendor tools, CRMs, or OT consoles sit outside normal internal monitoring. That makes containment dependent on privilege scope, session boundaries, and network isolation rather than authentication alone.

Practical implication: review delegated and vendor access paths as containment boundaries, not just onboarding records.

Microsegmentation as an east-west control, not a network luxury

Microsegmentation constrains east-west traffic so a compromised workload cannot freely discover, connect to, or encrypt adjacent systems. It is especially relevant where patching is slow, endpoints are diverse, or operational devices cannot be treated like standard office assets. The article frames segmentation as the practical control that slows attacker progression after initial compromise, which is why it matters in healthcare and OT as much as in conventional enterprise networks.

Practical implication: enforce workload-to-workload isolation around sensitive systems, not only perimeter controls around the network edge.

Threat narrative

Attacker objective: The attacker objective is to turn one initial compromise into wider data theft, operational disruption, or ransomware-ready access across multiple internal systems.

1. Entry occurs through a mix of zero-day exploitation, social engineering, exposed interfaces, or default credentials, depending on the incident cited in the article.
2. Credential or session abuse then gives the attacker durable access to internal systems, third-party applications, or operational consoles.
3. Escalation happens when flat internal trust allows the intruder to move from the first system into adjacent environments and reach sensitive data or infrastructure.
4. Impact follows as records are exposed, source code is stolen, or OT and healthcare systems become vulnerable to disruption.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Flat-network containment is now a governance failure, not just a design choice. When organisations assume that perimeter security is enough, they create a hidden privilege ladder inside the environment. That assumption breaks in healthcare and OT, where exposed systems often connect to sensitive data and operational controls. Practitioners should treat east-west isolation as part of access governance, not as an optional network enhancement.

Third-party access is part of the attack surface, not outside it. The Allianz Life example shows that SaaS and CRM access can become the operational edge of a breach when segmentation is absent. This intersects directly with IAM and NHI governance because delegated accounts, vendor tokens, and service credentials need the same containment logic as internal users. Security teams should reassess which external paths can still reach core assets after authentication.

Microsegmentation closes the containment gap that patching cannot. Patching reduces exposure to known vulnerabilities, but it does not stop movement once the attacker is already inside. The article’s healthcare and OT cases reinforce that the decisive control is limiting what one compromised system can touch next. Practitioners should align this to NIST-CSF PR.AA-05 and CIS account and segmentation controls when defining internal trust boundaries.

Containment must be designed for mixed environments. OT, healthcare, SaaS, and engineering systems fail in different ways, but attackers exploit the same weak point: overbroad internal reach. That creates what can be described as containment drift, where operational convenience slowly replaces enforced boundaries. The practical answer is to map where identity, workload, and network trust actually converge, then remove the assumptions that let one compromise spread.

The article shows that breach impact is increasingly decided after initial access. In other words, detection alone is not enough if the environment lets an attacker roam freely before anyone responds. This is why network microsegmentation, delegated access review, and least-privilege enforcement have to be treated as shared containment controls across IAM, NHI, and security operations.

From our research library:

• Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
• Read next: Guide to the Secret Sprawl Challenge

What this signals

Containment drift: internal trust expands quietly when teams optimise for convenience, then becomes visible only after an attacker starts moving laterally. That is the pattern this article exposes across healthcare, SaaS, and OT. Practitioners should treat internal segmentation as a continuously governed control, not a one-time architecture decision.

Where identity and access are delegated into third-party tools, the security boundary moves with them. That means vendor accounts, service credentials, and operational consoles need explicit containment rules as much as core workloads do, especially when the attack path crosses business and operational domains.

For practitioners

• Implement east-west segmentation around sensitive systems Divide healthcare, OT, and SaaS-connected workloads into smaller trust zones so one compromised host cannot freely reach adjacent assets.
• Review third-party and vendor access paths Inventory CRM, SaaS, and managed service access to confirm which delegated accounts can reach core systems after authentication.
• Remove default credentials and exposed admin interfaces Find HMI consoles, engineering tools, and administrative portals that are reachable from broader networks and lock them behind scoped access controls.
• Prioritise containment for high-value data and operations Place patient data systems, source code repositories, and operational technology in isolated zones with tightly controlled east-west traffic.
• Test breach spread, not just entry prevention Run scenarios that assume one system is already compromised and measure how quickly access can reach neighbouring assets before controls stop it.

Key takeaways

• The article’s central warning is that a single initial compromise is often enough to reach multiple internal systems when segmentation is weak.
• The examples span healthcare, SaaS, and OT, showing that lateral movement is not a niche issue but a cross-environment containment problem.
• The control that changes the outcome is limiting east-west reach so one compromised system cannot automatically become the next one compromised.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Third-Party Access: Third-party access is access granted to vendors, contractors, or support partners who are not direct employees of the organisation. It is higher risk than internal access because accountability, device assurance, and access duration are harder to control, so it usually requires tighter time limits and stronger auditability.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives practitioners a clearer way to govern identity risk across modern security programmes.