Topic starter
12/07/2026 12:26 pm
TL;DR: Breaches in healthcare, telecom, SaaS, and OT show the same pattern, according to ColorTokens: attackers gain entry, move laterally, and then turn access into larger operational and data impact. Containing internal movement, not just blocking initial compromise, is the decisive control in modern breach response.
Editorial analysis by NHI Mgmt Group, based on content published by ColorTokens: “From Google to Healthcare Giants: How Breaches Spiral Out of Control”.
By the numbers:
- The Change Healthcare ransomware attack hit 192.7 million people, according to ColorTokens.
Key questions
Q: What breaks when lateral movement is not contained after initial access?
A: When lateral movement is not contained, the attacker’s first foothold becomes a bridge into many more systems.
Q: Why does lateral movement make breaches much more damaging?
A: Lateral movement increases damage because the attacker can expand access after the first compromise instead of staying limited to one system.
Q: How do security teams know whether containment is actually working?
A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded.
Practitioner guidance
- Map east-west movement paths Identify which users, service accounts, workloads and SaaS connectors can traverse critical zones after one compromise, then remove unnecessary paths.
- Tighten privileged access scope Review admin roles, service accounts and delegated access to ensure no principal can reuse a single credential set across multiple sensitive systems.
- Segment business-critical zones Apply containment boundaries around healthcare, OT, finance and identity systems so a compromised endpoint cannot freely pivot into crown-jewel assets.
Bottom line: The central lesson is that the most damaging part of a breach often happens after the first compromise, when the attacker can move laterally through trusted systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:38 pm
Lateral movement is the real breach multiplier, not the headline entry vector. Organisations often over-focus on how attackers got in and under-focus on what they could touch next. The article’s examples show that the second phase, not the first, determines whether an incident becomes a contained event or a sector-level problem. For practitioners, the control question is how far a compromised principal can travel before it is stopped.
A few things that frame the scale:
- 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: What should teams do when compromised access could spread across SaaS, cloud and OT systems?
A: They should prioritise containment over assuming the initial compromise is the main problem. The practical response is to narrow internal trust, separate critical zones and remove unnecessary account reach so one compromised path cannot spread across environments. In mixed estates, the question is not whether intrusion can happen, but how far it can travel once it does.
👉 Read our full editorial: Lateral movement is the multiplier in breaches across sectors