Notifications
Clear all
Topic starter
30/07/2026 10:48 pm
TL;DR: Healthcare breaches reached more than 276 million compromised records in 2024, with the HIPAA Journal reporting over 700 large-scale incidents for the third consecutive year and Verizon DBIR finding stolen credentials remain the top initial access vector in the sector. Password policies built for compliance theatre, not live credential abuse, are now a liability.
NHIMG editorial — based on content published by Enzoic: Healthcare Password Security on Life Support
By the numbers:
- 2024 marked the third consecutive year with over 700 large-scale healthcare breaches reported, amounting to more than 276 million compromised records.
- In basic web app attacks, 88% of breaches involved the use of stolen credentials.
- 46% of compromised credentials came from unmanaged or BYOD endpoints.
Questions worth separating out
Q: What breaks when healthcare password policies are not tied to breach intelligence?
A: Password policies fail when they assume a credential is safe until the next reset cycle.
Q: Why do stolen credentials remain such a strong attack path in healthcare?
A: They work because they let attackers log in as legitimate users, which bypasses many perimeter and malware controls.
Q: How can security teams know if continuous credential monitoring is actually working?
A: Look for two signals: compromised credentials are being detected before adversaries use them, and account action follows quickly enough to prevent reuse.
Practitioner guidance
- Replace periodic password resets with exposure-driven action Force password changes only when a credential is confirmed or strongly suspected to be compromised, then pair the change with session review and access check.
- Screen new and changed passwords against breach corpuses Validate credentials at creation and reset time against known-compromised password datasets before they are accepted into Active Directory or remote access flows.
- Monitor in-use credentials continuously Watch active human and service credentials for later appearance in breach dumps or underground sources, and trigger account action when exposure is detected.
What's in the full article
Enzoic's full blog post covers the operational detail this post intentionally leaves for the source:
- Real-time credential screening at password creation and reset, including how the check is enforced in existing login flows.
- Continuous monitoring logic for Active Directory credentials after issuance, including trigger conditions for account action.
- How the control integrates with NIST and HITRUST-aligned password policies without adding unnecessary helpdesk friction.
- Why the article argues that arbitrary periodic password resets create noise while missing true compromise.
👉 Read Enzoic's analysis of healthcare password security and credential abuse →
Credential abuse in healthcare IAM: are your controls keeping up?
Explore further
30/07/2026 10:54 pm
Healthcare password security is really an identity governance problem, not a password policy problem. The article shows that complexity rules and periodic resets do little against valid credential abuse, which is the dominant access pattern in this sector. In IAM terms, the failure is a mismatch between static policy and dynamic compromise. Practitioners should treat breach corpus screening and identity telemetry as part of access governance, not as add-ons.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to the same report.
A question worth separating out:
Q: Who is accountable when a healthcare breach starts with a stolen password?
A: Accountability usually sits across IAM, security operations, and system owners because the failure is both governance and enforcement. If the organisation had a policy but no breach intelligence integration, ownership was incomplete. Frameworks such as HIPAA, NIST SP 800-63B, and HITRUST all imply active safeguards, not passive policy statements.
👉 Read our full editorial: Healthcare password security is failing under credential abuse
