Topic starter
24/06/2026 7:41 pm
TL;DR: Change Healthcare’s ransomware attack shows how compromised credentials without MFA can still bypass enterprise defenses, even in heavily regulated environments, according to Hydden. The case reinforces that identity hygiene, visibility, and control enforcement remain operationally difficult across hybrid estates, SaaS, and non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “United Healthcare Attack Underscores Importance of Foundational Identity Hygiene”.
Key questions
Q: What breaks when MFA is not enforced on every remote access path?
A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems.
Q: Why do hybrid identity environments increase ransomware risk?
A: Hybrid environments increase ransomware risk because identity data is fragmented across directories, SaaS, and on-premises systems, making it hard to prove control coverage.
Q: How do teams know whether identity hygiene is actually improving?
A: Look for fewer dormant accounts, fewer orphaned privileges, and shorter time-to-removal for leavers and role changes.
Practitioner guidance
- Audit MFA enforcement on all remote access entry points Confirm that every Citrix, VPN, SaaS, and privileged access path requires MFA, and document exceptions where legacy systems prevent consistent enforcement.
- Build a complete identity inventory across hybrid estates Correlate Active Directory, cloud directories, SaaS accounts, and machine identities so missing accounts, duplicate accounts, and orphaned access can be found quickly.
- Extend governance to non-human accounts Include service accounts, application accounts, and other machine identities in access reviews, ownership assignment, and lifecycle tracking so they do not become invisible exceptions.
Bottom line: The article frames identity hygiene as a practical ransomware problem because compromised credentials can still reach critical systems when MFA is missing or inconsistently enforced.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:04 am
Identity hygiene failures are still a live ransomware control gap, not a solved problem. The Change Healthcare case shows that a well-known control like MFA can still be absent at the exact point of entry attackers choose. That means the real failure is not awareness, but inconsistent enforcement across a hybrid estate. The practitioner implication is that identity hygiene must be treated as an operational control plane, not a policy statement.
A few things that frame the scale:
- 55% of healthcare data breaches now originate from a third-party vendor, according to Ponemon Institute’s 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: How should security teams run access reviews for non-human identities?
A: Security teams should scope reviews by risk pattern, assign every identity to an accountable owner, and require a documented decision for each item in scope. The workflow should allow direct remediation for obvious cases and owner follow-up for the rest. The goal is not just certification but a clean audit trail and a clear end state for each credential.
👉 Read our full editorial: Identity hygiene failures still expose ransomware paths in hybrid IAM