The Target: Newman Regional Health, a U.S based Kansas hospital
The Take: Exposure of Personally Identifiable Information of 52,000 individuals including: names, medical record numbers, employee information, dates of birth, email addresses, phone numbers, and physical addresses.
The Vector: A threat actor gained access to compromised employee email accounts, and acting with all the same permissions as the breached credentials, exfiltrated the above data.
This breach is a stark reminder of the importance of not only robust employee credential authentication and password hygiene, but also regular internal system scanning. The threat actor had access to the compromised system for nearly a year. Performing regular monitoring on account behaviour is critical to ensure access is kept within the firm. Additionally, locking down appropriate permissions, admin access, and ensuring users only need the tools they need to do their jobs, and no more, will reduce the risk of these attacks.