DC Medicaid agency exposed personal and protected health information for approximately 400,000 beneficiaries due to an online data exposure.
Paubox angle · Data Loss Prevention: A 400k+ breach at a state Medicaid agency demonstrates the risk of uncontrolled PHI exposure. Healthcare organizations handling Medicaid data should evaluate whether DLP controls are in place to prevent sensitive beneficiary information from leaving via email.
Microsoft reports Star Blizzard has refined phishing and malware delivery tactics using the RedFlick technique, a threat actively targeting healthcare and other sectors.
Paubox angle · Inbound Security upgrade: Star Blizzard's evolving phishing techniques are a direct threat to healthcare inboxes. Customers need advanced AI-driven inbound email security to detect and block these sophisticated delivery methods before they reach users.
HospitalsSpecialty practicesHealthTechBehavioral health
Astrana Health, a managed services organization serving healthcare providers, notified the SEC of a social engineering incident affecting its systems and potentially its healthcare clients.
Paubox angle · Inbound Security upgrade: Social engineering and phishing attacks often target email access as the entry point. Astrana's incident is a peer-pressure moment for its MSO client base—proactive inbound email security and staff training are critical to prevent similar breaches.
A new CalPhishing campaign exploits internal email forwards to turn them into credential-stealing lures, targeting organizations across sectors including healthcare.
Paubox angle · Inbound Security upgrade: Email-based credential theft via internal forwards is a direct threat that inbound security must intercept. This is a timely conversation starter with customers about advanced phishing detection and employee email behavior.
Modoc Medical Center and Vista Del Mar Child and Family Services in California announced cybersecurity incidents affecting patient data.
Paubox angle · Inbound Security upgrade: These breaches are a peer-pressure moment for other California critical access hospitals and behavioral health providers. If the incidents involved email-based compromise or data exfiltration, it's a direct inbound security and DLP conversation.
MEDIMPACT data breach exposed social security numbers and health information; law firm investigating on behalf of affected individuals.
Paubox angle · Data Loss Prevention: Large healthcare data breach affecting multiple individuals increases scrutiny across the sector; customers should audit email security controls to prevent downstream PHI exfiltration.
Mandiant warns of vishing attacks that bypass MFA on SaaS platforms, a social engineering tactic targeting cloud-based access.
Paubox angle · Inbound Security upgrade: Vishing (voice phishing) combined with email-based credential theft is a top entry vector for healthcare breaches; inbound email security can detect and block related phishing attempts.
HospitalsSpecialty practicesTelehealthBehavioral health
Threat groups are ramping up social-engineering attacks against the healthcare sector, signaling a broad shift in attack tactics targeting healthcare organizations.
Paubox angle · Inbound Security upgrade: This trend underscores the need for inbound email security with AI-powered phishing and social-engineering detection—exactly what Paubox Inbound Email Security is designed to catch.
A medical data breach in Poland exposed data of up to 5 million people, representing a large-scale healthcare privacy incident.
Paubox angle · Data Loss Prevention: Large-scale healthcare breaches underscore the need for comprehensive data protection strategies, including secure email handling and DLP controls to prevent PHI exposure during routine communications.
Luminis Health suffered a cyberattack in August 2026. Details remain limited, but the incident has drawn media scrutiny and patient concern.
Paubox angle · Inbound Security upgrade: A health system breach is a peer-pressure moment for the whole sector. Email-based attacks (phishing, BEC, ransomware) are common entry points; a conversation about inbound security and archiving can help protect against similar incidents.