Topic starter
30/07/2026 10:48 pm
TL;DR: Healthcare breaches exceeded 276 million compromised records in 2024 and over 700 large-scale incidents for the third straight year, according to Enzoic, while Verizon’s healthcare snapshot says credential abuse remains the top initial access vector. Password policy alone is no longer a credible defence when attackers simply log in.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Healthcare Under Pressure”.
By the numbers:
- Healthcare breaches exceeded 276 million compromised records in 2024, a 64% spike over 2023, according to Enzoic.
- In the first five months of 2025, over 23 million additional individuals have already been affected by healthcare breaches, according to Enzoic.
- In 2024, 46% of compromised credentials came from unmanaged or BYOD endpoints, according to Enzoic.
Key questions
Q: What fails first when healthcare password policy is built around complexity and resets?
A: The first failure is that policy compliance does not prevent valid credentials from being stolen, reused, or bought elsewhere.
Q: Why do stolen healthcare credentials create so much downstream risk?
A: Because a valid login can open multiple systems that were never meant to share the same trust assumption.
Q: What signs suggest healthcare credential controls are not working?
A: Repeated reuse of weak passwords, exposure of active accounts in breach corpuses, and successful logins from credentials that should already be stale are strong warning signs.
Practitioner guidance
- Implement continuous breach screening Check every new and changed password against live breach corpuses, then re-screen active credentials so previously safe passwords do not stay trusted after later exposure.
- Tie Active Directory to compromise signals Integrate credential monitoring into Active Directory workflows so exposed accounts can be flagged, forced to change, or disabled before the credential is reused.
- Retire calendar-based reset rituals Replace blanket 90-day password resets with risk-based change events triggered by exposure evidence, because arbitrary rotation can push users toward weaker password behaviour.
Bottom line: Healthcare password controls are failing because attackers are using valid credentials, not trying to break authentication.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:54 pm
Healthcare password policy has become a compliance veneer, not a security control. Complexity rules and forced reset cycles do not stop credential abuse when attackers already hold valid logins. The deeper problem is that organisations still treat passwords as a point-in-time event instead of a continuously exposed asset. The implication is that healthcare IAM programmes must stop measuring policy compliance and start measuring exposure.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do first when breach data shows that passwords may already be exposed?
A: The first step is to identify which accounts use the exposed credentials, then replace any reused or weak passwords with strong, unique ones. Teams should also assume that the same email and password combination may unlock multiple services, so they need to prioritise high-value accounts, especially admin and email accounts, before attackers can reuse stolen logins at scale.
👉 Read our full editorial: Healthcare password security is failing under credential abuse