OCR fined Ambry Genetics $700K over a breach linked to inadequate HIPAA Risk Analysis practices, highlighting enforcement focus on preventive security controls.
Paubox angle · Inbound Security upgrade: OCR enforcement on risk analysis gaps reinforces that organizations must demonstrate concrete controls to detect and prevent email-based threats and data exposure. This strengthens the business case for inbound security and DLP as compliance evidence.
Microsoft reports Star Blizzard has refined phishing and malware delivery tactics using the RedFlick technique, a threat actively targeting healthcare and other sectors.
Paubox angle · Inbound Security upgrade: Star Blizzard's evolving phishing techniques are a direct threat to healthcare inboxes. Customers need advanced AI-driven inbound email security to detect and block these sophisticated delivery methods before they reach users.
HospitalsSpecialty practicesHealthTechBehavioral health
Astrana Health, a managed services organization serving healthcare providers, notified the SEC of a social engineering incident affecting its systems and potentially its healthcare clients.
Paubox angle · Inbound Security upgrade: Social engineering and phishing attacks often target email access as the entry point. Astrana's incident is a peer-pressure moment for its MSO client base—proactive inbound email security and staff training are critical to prevent similar breaches.
A new CalPhishing campaign exploits internal email forwards to turn them into credential-stealing lures, targeting organizations across sectors including healthcare.
Paubox angle · Inbound Security upgrade: Email-based credential theft via internal forwards is a direct threat that inbound security must intercept. This is a timely conversation starter with customers about advanced phishing detection and employee email behavior.
Modoc Medical Center and Vista Del Mar Child and Family Services in California announced cybersecurity incidents affecting patient data.
Paubox angle · Inbound Security upgrade: These breaches are a peer-pressure moment for other California critical access hospitals and behavioral health providers. If the incidents involved email-based compromise or data exfiltration, it's a direct inbound security and DLP conversation.
MEDIMPACT data breach exposed social security numbers and health information; law firm investigating on behalf of affected individuals.
Paubox angle · Data Loss Prevention: Large healthcare data breach affecting multiple individuals increases scrutiny across the sector; customers should audit email security controls to prevent downstream PHI exfiltration.
Mandiant warns of vishing attacks that bypass MFA on SaaS platforms, a social engineering tactic targeting cloud-based access.
Paubox angle · Inbound Security upgrade: Vishing (voice phishing) combined with email-based credential theft is a top entry vector for healthcare breaches; inbound email security can detect and block related phishing attempts.
HospitalsSpecialty practicesTelehealthBehavioral health
Threat groups are ramping up social-engineering attacks against the healthcare sector, signaling a broad shift in attack tactics targeting healthcare organizations.
Paubox angle · Inbound Security upgrade: This trend underscores the need for inbound email security with AI-powered phishing and social-engineering detection—exactly what Paubox Inbound Email Security is designed to catch.
A medical data breach in Poland exposed data of up to 5 million people, representing a large-scale healthcare privacy incident.
Paubox angle · Data Loss Prevention: Large-scale healthcare breaches underscore the need for comprehensive data protection strategies, including secure email handling and DLP controls to prevent PHI exposure during routine communications.
Breaches announced at Gastroenterology & Hepatology of Central New York, Three Oaks Hospice, and Doctor's Choice Home. Specialty practices and home health are seeing active breach activity.
Paubox angle · Inbound Security upgrade: Peer-pressure moment for gastroenterology practices and hospice/home health operators to review email security posture and whether inbound threat detection is in place to prevent breach-enabling phishing.