Recent cybersecurity warnings and incidents are highlighting healthcare cyber risks beyond ransomware, including cloud authorization abuse, voice phishing, brand impersonation, third-party access, and publicly exposed information, all reported by Becker’s in September alone.
1. OAuth Consent Phishing Within This Healthcare Cyber Risks Beyond Ransomware List
The FBI warned about “OAuth consent phishing,” which can give attackers account access without stealing a password. Attackers send links that lead victims to permission screens from legitimate cloud providers, such as Microsoft or Google. If permission is granted, a malicious application can receive access to email and other data through an authorization token. The American Hospital Association directed member hospitals to the FBI alert.
Why This Technique Bypasses Traditional Password Defenses
Because this attack method never requires stealing a password in the first place, it circumvents many of the standard credential-protection safeguards hospitals rely on, instead exploiting the legitimate permission-granting mechanisms built into everyday cloud services like Microsoft and Google.
2. Voice Phishing and Domain Impersonation Within This Healthcare Cyber Risks Beyond Ransomware List
Health-ISAC warned healthcare organizations about voice phishing and domain impersonation tied to ShinyHunters. The group said attackers have registered lookalike domains, impersonated internal departments such as IT help desks, and pressured victims to approve multifactor authentication requests. Health-ISAC said it had sent targeted alerts to multiple health sector organizations after observing the group bypass multifactor authentication and move from single sign-on platforms into connected software-as-a-service applications.
Why Impersonating IT Help Desks Specifically Is Effective
Impersonating an internal department like IT help desk exploits the routine trust employees place in support staff who legitimately request account verification or access approval, making this a particularly effective vector for pressuring victims into approving fraudulent multifactor authentication requests.
3. The MyChart Phishing Campaign Within This Healthcare Cyber Risks Beyond Ransomware List
Dozens of health systems have warned patients about a phishing campaign impersonating MyChart. The messages promote a purported “MyChart Medicare Kit” or “Senior Health Package” and direct recipients to fraudulent sites. The FTC has received 166 complaints over the past five years referencing MyChart, with several related to the current campaign. The campaign does not stem from a breach of MyChart, and Epic has said the platform’s security is unaffected.
Why This Campaign Has Required Dozens of Independent Warnings
Because this scam exploits the widespread trust patients place in the MyChart brand itself rather than any actual platform vulnerability, no single vendor patch exists to resolve it, forcing dozens of individual health systems to each discover and warn their own patients independently.
4. Veradigm’s Third-Party Vendor Breach Within This Healthcare Cyber Risks Beyond Ransomware List
EHR vendor Veradigm disclosed a cybersecurity incident involving credentials obtained from a third-party vendor’s environment. An unauthorized party used the credentials to access a Veradigm application programming interface and download personal information tied to a small number of customers, including Social Security numbers in some cases. Veradigm said no clinical or medical data was involved and the incident did not provide access to its broader network, servers, or databases or disrupt operations.
Why Third-Party Credential Theft Remains a Persistent Entry Point
This incident illustrates a recurring pattern in healthcare cybersecurity, where attackers gain access not through directly compromising a vendor’s own systems, but by stealing credentials from a separate third-party environment and using them to access connected APIs, underscoring the risk concentrated in vendor supply chains.
5. Exposed Clinician Data Within This Healthcare Cyber Risks Beyond Ransomware List
Nearly 50 hospitals and health systems had publicly accessible webpages that exposed clinicians’ schedules and, in some cases, cellphone numbers. The information was accessible through pages associated with workforce management platform QGenda. At least 10 hospitals and health systems removed the public links or added password requirements after being contacted by the publication. The report described publicly accessible information, not a cyberattack or breach of QGenda.
Why This Represents a Distinct Risk Category
Unlike the other four items on this list, this exposure did not stem from an active attack at all, but from a configuration and access-control oversight, highlighting how basic web page privacy settings can create real security risk for clinicians even without any malicious intrusion occurring.
What This Healthcare Cyber Risks Beyond Ransomware List Means Going Forward
Given that these five incidents span cloud authorization abuse, social engineering, brand impersonation, vendor credential theft, and simple misconfiguration, hospitals and health systems should recognize that a security strategy focused primarily on ransomware prevention leaves significant gaps across other attack vectors actively being exploited right now. Given the recurring role third-party vendors and platforms played in several of these incidents, health system security teams may want to prioritize auditing vendor access controls and public-facing configuration settings alongside their more traditional ransomware defense investments.
What to Watch Going Forward
As these five threat categories continue evolving, industry observers will likely watch whether more health systems adopt OAuth-specific monitoring and MFA-bypass detection tools in response to the FBI and Health-ISAC warnings, and whether additional organizations discover similar QGenda-related public exposure issues beyond the initial nearly 50 identified. Given the breadth of this healthcare cyber risks beyond ransomware list, hospitals may need to expand their cybersecurity training and technical safeguards well beyond ransomware-specific defenses to address the full range of threats currently targeting the sector.
For more healthcare industry updates, insights and news, visit DistilINFO. Click here to subscribe to stay informed
