Topic starter
27/06/2026 2:06 pm
TL;DR: Healthcare attackers compromised 280 million patient records in 2024, or 83% of the U.S. population, as AI-driven phishing, deepfakes, and identity abuse pushed past legacy defenses, according to Abnormal AI. The governance gap is no longer awareness alone but whether identity, MFA, and behavioural controls can still separate normal activity from machine-speed impersonation.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “When Trust Becomes a Threat: Securing Healthcare at the Human Level”.
By the numbers:
- Cyber attackers compromised 280 million patient records in 2024.
- Those breaches affected 83% of the U.S. population.
- BJC Health System cut manual email triage by 75% using AI-based behavioral detection.
Key questions
Q: What fails when AI-powered phishing looks like normal healthcare communication?
A: Static filters and one-time identity checks fail when the attacker can imitate tone, timing and workflow context.
Q: Why do MFA and access approvals still get bypassed in healthcare?
A: Because MFA proves a step was completed, not that the request was trustworthy.
Q: What are the warning signs that identity abuse is hiding in normal care workflows?
A: Look for requests that match expected language but arrive from unusual timing, atypical senders, odd device patterns or unfamiliar approval paths.
Practitioner guidance
- Adopt behaviour-based email and identity detection Prioritise tools and workflows that score sender behaviour, message context and session anomalies rather than relying on static indicators alone.
- Rework MFA into a broader trust control Treat MFA as necessary but insufficient, and add checks for conversation context, device reputation, workflow fit and unusual approval patterns.
- Extend monitoring to third-party access paths Inventory vendor, referral and partner workflows, then monitor them for identity misuse with the same urgency applied to internal accounts.
Bottom line: AI-powered impersonation is changing healthcare identity risk from obvious phishing into behaviourally plausible abuse that can pass traditional controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:43 pm
Legacy identity controls are losing the ability to distinguish trust from legitimacy. The article shows that AI-powered attacks can now imitate voice, tone, timing and workflow context well enough to bypass the human cues many programmes still rely on. That shifts the problem from simple access verification to identity behaviour verification, especially in sectors where urgency and trust are built into daily operations. Practitioners should treat this as a governance failure in how trust is inferred, not just a phishing problem.
A few things that frame the scale:
- 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: Who should own third-party identity governance in healthcare organisations?
A: Third-party identity governance should sit with IT or security teams, not HR or individual business units. Healthcare providers rely on contractors, visiting staff, and suppliers, so governance must cover onboarding, access requests, and ongoing control regardless of identity type. Central ownership helps maintain consistent policy enforcement, reduce risk, and support regulatory compliance across internal and external workforces.
👉 Read our full editorial: AI-powered healthcare attacks are outpacing legacy identity controls