Topic starter
28/04/2026 4:11 pm
TL;DR: A single compromised Okta login gave attackers standing access to Hims & Hers’ Zendesk instance, exposing millions of customer records in a breach tied to a common third-party access pattern, according to Apono. The lesson is plain: zero standing privilege, not just stronger authentication, is now a healthcare governance requirement.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “The Hims Data Breach: What Standing Access Costs in Healthcare”.
Key questions
Q: What breaks when a vendor account has standing access to healthcare systems?
A: When standing access exists, a stolen or phished login can immediately reach connected systems without another privilege decision.
Q: Why does standing access increase breach impact in healthcare?
A: Because the attacker does not need to wait for a separate approval or discover a hidden escalation path.
Q: How do teams know whether zero standing privilege is actually working?
A: Teams should look for evidence that privileged access is time-bound, fully revoked, and impossible to reuse outside the approved session.
Practitioner guidance
- Map every standing vendor access path Inventory third-party accounts that can reach regulated systems, then confirm whether each one still needs always-on access to production data or support tooling.
- Move support workflows to Just-in-Time issuance Require task-scoped privilege for external support and integration accounts so access is created only when a specific request is active and removed when the task closes.
- Recertify external entitlements against business ownership Tie each vendor account to a named internal owner, a defined use case, and a renewal date so stale access can be revoked before it becomes invisible risk.
Bottom line: The breach shows that persistent third-party access can turn a single compromised login into direct exposure of regulated healthcare data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 9:00 pm
Standing access is the governance failure, not the phishing event. The phishing step explains how the attackers entered, but the breach became material because the compromised account already held usable access to Zendesk. That is a lifecycle and privilege design failure, not an authentication-only failure. The practical conclusion is that persistent privilege on connected systems must be treated as part of the attack surface itself.
A few things that frame the scale:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
A question worth separating out:
A: After a third-party account is identified as the entry point, organisations should revoke exposed credentials, review all connected access paths, reset affected sessions, and determine whether the same trust relationship exists elsewhere. They should also validate logs, notify internal stakeholders, and tighten vendor controls before restoring normal access. The key objective is to stop lateral movement and prevent repeat exposure through the same relationship.
👉 Read our full editorial: Hims breach shows standing access is the real healthcare risk