Healthcare organizations are turning a blind eye to phishing attacks
A survey reveals that most attacks go unreported, putting patient data at risk
The vast majority of phishing attacks against the healthcare sector go unreported to security teams, leaving organizations unable to fully learn from their mistakes.
In a survey of 150 US-based healthcare IT leaders for secure email firm Paubox, six-in-ten said they had experienced at least one email security breach last year, and three-quarters that they expected even more security challenges this year.
The top risks were phishing, man-in-the-middle attacks, and password guessing, often through personal information revealed on social media.
However, IT leaders said 95% of phishing attacks went unreported to security teams, along with 96% of known email violations of the 1996 Health Insurance Portability and Accountability Act (HIPAA), aimed at protecting sensitive health information from disclosure without patient's consent.
As a result, these incidents weren't investigated, meaning that systems weren’t patched, staff weren’t alerted, and patients weren’t warned that their data may be at risk.
"We encountered a significant case where an outdated email system directly impacted patient care due to a cybersecurity breach," said Matt Murren, CEO of healthcare IT support firm True North ITG.
"The phishing attack compromised user credentials and eventually deployed ransomware across the network. It shut systems down for two weeks. Appointments were delayed. Test results were inaccessible. Urgent care cases were diverted elsewhere. Patients lost trust. This isn’t just an IT failure — it’s a patient safety crisis."
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
The problem doesn't seem to be a lack of awareness amongst staff. Nine-in-ten said they carried out staff training.
Ryan Winchester, CareM director of information technology, said "no amount of training can completely eliminate human error, so businesses must have safeguards in place."
The report found that healthcare organizations currently allocate only 11–20% of their IT budgets to email security, despite email being their top risk area. One persistent problem is poor infrastructure, with 83% of healthcare IT leaders saying that legacy systems disrupt day-to-day operations.
"I’ve seen first-hand how legacy email platforms can quietly — but critically — undermine operational stability and efficiency across healthcare organizations" said Murren.
In larger healthcare networks, the most common challenges include high maintenance costs that drain IT resources, persistent security vulnerabilities, outdated and complex user interfaces, system performance bottlenecks, and limited support for mobile and remote working.
The result is reactive firefighting, with about 37% of healthcare IT leaders spending between 11 and 20 hours per week just resolving secure email tickets.
"Healthcare doesn’t need more patchwork fixes — it needs a mindset shift. Patients expect secure, convenient communication, and it’s on us to meet that standard," said CEO of Paubox Hoala Greevy.
MORE FROM ITPRO
- Are phishing tests a waste of time?
- 10 quick tips for identifying phishing emails
- Phishing tactics: The top attack trends
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
PagerDuty wants to supercharge incident response with a new SRE agentNews The new Paige agent from PagerDuty will act as a digital assistant for teams battling incidents
-
Dejected devs lament career prospects amid AI advancesNews A new survey has found that AI is fundamentally changing the developer role and many are getting anxious
-
Microsoft Teams is getting a suite new AI features to crack down on phishing attacksNews A sharp rise in phishing attacks against Microsoft Teams has prompted a raft of new features
-
Microsoft takes down ‘EvilTokens’ hacker service that used AI to ‘decide who to target, who to impersonate, and how to most effectively exploit’ victimsNews In just six months, the EvilTokens phishing as a service platform hit thousands of organizations worldwide
-
Cyber criminals are adapting ASCII smuggling for mass phishing campaignsNews Usually known for its use in prompt injection attacks, ASCII smuggling is now being used to evade spam filters on email platforms
-
Data belonging to 3.75 million patients was exposed in the CareCloud breach – not the 350,000 originally reportedNews The number of victims in the CareCloud breach has surged to over three and a half million
-
Delta Airlines flight Wi-Fi tampered with after DEF CON conferenceNews A rogue network named 'Delta WiFi Fast' was created in an apparent in-flight phishing attack
-
NCSC issues alert over 'zero-click' phishing campaign hitting enterprisesNews Ukrainian organizations were used to test new zero-click techniques employed by Russian hackers
-
Health tech firm Craneware admits “significant volume” of customer and employee data exposed in cyber attackNews The incident has been contained and Craneware has launched a probe into the breach
-
Multi-channel phishing attacks: How to manage the riskIn-depth Attackers are evolving beyond email towards phishing across multiple channels. Why is this, and what can be done to manage the risk?