[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh6VPN_olUhFV3cn--5KsJ8EsmtNvCcE-cJKBtb_OOTE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"b8d81475-241f-493a-8910-3f5e8d9e2e82","social-engineering-and-ransomware-expose-250000-healthcare-patients","9173723d-3474-4e79-8705-3751ddbf3e81","Social Engineering and Ransomware Expose 250,000 Healthcare Patients","Two separate healthcare breaches affecting over 250,000 individuals highlight persistent vulnerabilities in employee account security and data protection practices. Clover Health fell victim to social engineering that compromised three employee accounts, demonstrating that human manipulation remains one of the most effective attack vectors. AngMar Management Services suffered a ransomware attack by the Interlock group, resulting in over 700 GB of sensitive PHI being publicly leaked. These incidents underscore the critical importance of healthcare organizations investing in both technical controls and human-layer defenses, as attackers frequently exploit the weakest link — people — to gain initial access before exfiltrating or encrypting sensitive data.","**Immediate actions:**\n- Deploy multi-factor authentication (MFA) on all employee accounts, especially those with access to PHI and PII.\n- Conduct emergency phishing and social engineering simulation training for all staff with access to sensitive patient data.\n- Audit and restrict privileged access to only those roles that require it using least-privilege principles.\n\n**Long-term improvements:**\n- Implement a Zero Trust architecture to continuously verify user identity and device posture before granting access to sensitive systems.\n- Classify and encrypt all stored PHI\u002FPII at rest and in transit to limit exposure in the event of unauthorized access.\n- Establish a formal data loss prevention (DLP) program to detect and block large-scale unauthorized data exfiltration.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tools to identify ransomware behavior patterns and lateral movement early.\n- Enable centralized logging and SIEM alerting for anomalous account activity, such as after-hours logins or bulk data access.\n- Establish a threat intelligence feed subscription to receive early warnings about active ransomware groups like Interlock targeting the healthcare sector.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 3: Data Protection","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 IR-4: Incident Handling","HIPAA Security Rule 45 CFR § 164.308(a)(5): Security Awareness Training","HIPAA Security Rule 45 CFR § 164.312(a)(1): Access Control","HIPAA Breach Notification Rule 45 CFR §§ 164.400-414","NIST Cybersecurity Framework DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing",{},"published","2026-10-05T14:21:11.733887+00:00","2026-10-05T14:21:11.44+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.securityweek.com\u002F250000-impacted-by-data-breaches-at-new-jersey-texas-healthcare-firms\u002F","250-000-impacted-by-data-breaches-at-new-jersey-texas-healthcare-firms-bd4b7f","250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":62,"name":63,"problem":64},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back."]