Topic starter
13/10/2026 1:21 pm
TL;DR: 88% of traceable cases with a named attack vector involved a phished or stolen credential, while supply chain incidents made up six of the ten largest breaches ever, according to Crayonic analysis of 7,834 US healthcare breach filings. The pattern shows that identity assurance and third-party control are now the decisive containment variables.
Editorial analysis by NHI Mgmt Group, based on content published by Crayonic: “Healthcare Breach Evidence Review”.
Key questions
Q: What fails when healthcare systems still trust phished credentials?
A: The failure is not only the stolen password itself, but the assumption that authenticated access is therefore legitimate.
Q: Why do vendor incidents create outsized breach impact in healthcare?
A: Third-party access often carries broad, durable reach into production systems, so a compromise can spread through trusted connections rather than noisy exploitation.
Q: What are the signs that identity controls are not containing breach blast radius?
A: Warning signs include remote-access accounts with broad data reach, vendors that retain standing access after projects end, and breach reports that repeatedly start with valid credentials.
Practitioner guidance
- Tighten phishing-resistant authentication for remote access Require stronger authentication for portals that can reach protected health information, especially any remote-access path that currently accepts reusable passwords or weak MFA.
- Rebuild third-party access governance Inventory vendor accounts, tokens, and support pathways, then remove standing access that remains active after the business need ends.
- Reduce reachable blast radius for privileged identities Segment sensitive data paths so a single authenticated session cannot reach large record sets or administrative functions without additional controls.
Bottom line: Healthcare breach patterns continue to show that valid credentials are the common path to major losses, not just isolated account abuse.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 1:22 pm
Phished credentials are still the cleanest path to catastrophic healthcare loss. The article’s core finding is not that attackers are especially sophisticated, but that valid authentication remains the easiest way through the door. When a remote-access portal accepts a stolen identity, network controls and data-store hardening arrive too late. The practitioner conclusion is blunt: identity assurance must be treated as a front-line breach prevention control.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should healthcare teams prioritise credential defence versus server patching?
A: Both matter, but the article shows that credential abuse is tied to the biggest losses while unpatched systems more often produce smaller incidents. That means teams should prioritise the identities and access paths that can reach high-value records first, then use patching to reduce the broader intrusion surface.
👉 Read our full editorial: Phished credentials drive the largest healthcare breaches