Social Engineering: The New Front Door to Healthcare Data
Social engineering attacks in healthcare are targeted attempts to trick workers or vendors into granting access to business applications, allowing attackers to steal patient health information and other sensitive data without directly hacking medical systems. Instead of breaking encryption or exploiting software flaws, criminals pose as trusted colleagues, vendors, or support staff to bypass technical controls. In the iRhythm incident, attackers used social engineering to infiltrate third-party-hosted business applications, later claiming they had obtained proprietary data, protected health information, and other personal details. The intruders stayed away from clinical systems and medical devices, focusing on the tools staff use every day to manage operations and data. This pattern highlights a shift in healthcare cybersecurity threats: the human element—busy clinicians, administrative staff, and vendor contacts—has become a primary entry point for attackers seeking valuable patient data.
Business Applications and Vendors as Primary Attack Vectors
The iRhythm healthcare data breach shows how third-party business applications can become high-value targets when attackers want to avoid hardened clinical environments. iRhythm reported that the intrusion was limited to business applications hosted by external providers, keeping clinical systems, medical devices, and patient care services intact. Yet the stolen data still included patient protected health information and proprietary company data, proving that non-clinical systems often hold rich, exploitable records. Similar patterns surface in other incidents where attackers focus on internal IT and research environments instead of frontline medical devices. As healthcare organizations adopt more cloud services and vendor integrations, every shared platform, support portal, and analytics tool expands the attack surface. When access to these tools is granted through social engineering, medical device security on its own cannot stop the theft of patient data stored in connected business systems.
Patient Health Information as the Common Prize
Across recent healthcare cybersecurity threats, patient health information remains the central prize. In the iRhythm case, attackers claimed they had obtained patient protected health information along with proprietary and personal data, then demanded payment to avoid public disclosure. According to iRhythm’s regulatory filing, “the incident was material because of the volume of potentially affected information.” In the Novo Nordisk breach, intruders accessed internal IT systems and copied data on patients in clinical trials, including patient IDs, year of birth, sex, biomarkers, health and immunogenicity data, and lifestyle factors. While Novo Nordisk stressed that the data was pseudonymized and did not contain direct identifiers, it still represents a detailed health profile that could be combined with other information. These incidents show how coordinated attacks on medical device makers and pharmaceutical firms are tuned to exfiltrate sensitive health datasets rather than disrupt care.
Targeting People, Not Devices: A Growing Pattern
Recent breaches show attackers focusing on people instead of direct technical exploits. iRhythm’s investigation attributes its incident to social engineering, a method that often includes phishing emails, support desk impersonation, or fraudulent access requests aimed at busy staff. In parallel, Novo Nordisk reported that attackers gained unauthorized access to a limited number of internal IT systems and exfiltrated research and patient-related data, with a group calling itself Dragonfly later claiming responsibility for copying model checkpoints, proprietary training datasets, internal infrastructure maps, and more. In both cases, attackers avoided obvious medical device security targets and instead moved through business, research, and IT environments where staff interaction is constant. This shift underscores that the most efficient way into healthcare data stores may be through a convincing message or a spoofed call, not a sophisticated exploit against a device or hospital system.
Strengthening Vendor Security and Staff Awareness
To reduce the risk of a healthcare data breach, organizations need stronger vendor security protocols and consistent employee awareness training. Vendor due diligence should cover how third-party-hosted applications store and protect patient health information, the access controls they use, and how they respond to incidents. Contracts can require security baselines, audit rights, and rapid notification of suspicious activity. Internally, staff must be trained to recognize social engineering attacks, from unusual password reset requests to unexpected messages asking for remote access. Simple practices—verifying identities through known channels, limiting access rights, and using multifactor authentication—can block many attacks that rely on human error. iRhythm’s experience, where business applications were compromised while clinical systems remained safe, shows that defenses must extend beyond medical devices to every system and vendor connection that touches patient data.
