The Breach Pattern Every Healthcare Organization Should Know About (And Probably Can't See)
You've spent millions on security infrastructure. Your SIEM is sophisticated. Your SOC team is competent. Your firewall rules are tight.
And a compromised vendor credential just walked out with millions of patient records.
This isn't speculation. This is what happened to McKesson in August 2026. This is what happened to Veradigm in September 2026. And if you can't see your vendor access patterns in real time, this is probably happening to you right now.
How Two Major Healthcare Breaches Became Invisible
McKesson's attack timeline is deceptively simple:
A vendor's employee received a vishing call. The attacker impersonated IT support. One credential was compromised. That single credential became a skeleton key to systems holding 284 million patient records.
The attacker didn't need zero-days. They didn't need to bypass your firewall or exploit a vulnerability in your authentication layer. They just needed one password that worked.
They logged into Okta SSO. From there, they accessed Salesforce. Then Snowflake. They downloaded six months of patient data: names, Social Security numbers, Medicaid information, medications, allergies, appointment histories. By the time McKesson's security team realized what was happening, ShinyHunters already claimed responsibility and demanded $55.2 million.
Veradigm's breach followed the same playbook.
A vendor's environment was compromised. The attacker obtained credentials to a Veradigm API reserved for vendor services. Using those credentials, they downloaded personal data from 3.5 million patients. The Gentlemen ransomware gang claimed the theft on their leak site and threatened to publish the data.
The pattern in both cases is identical: compromise a vendor's credential, authenticate into the healthcare organization's systems, exfiltrate data, and disappear.
Your security team saw none of it.
Why Your Firewall Caught Nothing
This is the uncomfortable truth that most healthcare organizations aren't comfortable discussing: your security infrastructure was built to catch a different kind of threat.
The Authentication Problem
Your systems have no concept of malicious authenticated access. If credentials are valid, they're approved.
A vendor credential logging in from Romania at 3 AM looks identical to a vendor credential logging in from their corporate office at 9 AM. Both are authenticated. Both are authorized. Both pass through every gate without triggering an alert.
Your SIEM doesn't flag this as suspicious because it isn't. It's exactly what vendor credentials are supposed to do.
The Trust Problem
You outsourced vendor risk management to third-party compliance scorecards. SecurityScorecard says the vendor is SOC 2 certified. You completed your vendor due diligence. So you stopped looking.
But a compliance score doesn't tell you if one of their employees used the same password across personal and work accounts. It doesn't tell you if a contractor still has access after being terminated. It doesn't tell you if their security infrastructure failed yesterday.
A SOC 2 certification is a snapshot from six months ago. A compromised credential is happening right now.
The Perimeter Problem
Your entire security architecture is built around defending a perimeter that no longer exists.
Your firewall catches lateral movement inside your network. Your SIEM catches command execution. Your EDR catches malware. All of it is designed to stop attackers who have to break their way inside.
Vendor credentials mean the attacker never has to break in. They're already inside. They're already trusted. They have legitimate access to your patient database through APIs and integrations that your monitoring doesn't touch.
Identity is the new perimeter. And you're defending the old one.
By the time your monitoring recognizes something is wrong, the pattern of life for that vendor account has already shifted. They've downloaded six months of records. They've exported patient data to staging servers. They've disappeared.
And you're still waiting for an alert that will never come.
This Isn't Rare. This Is The New Normal.
Healthcare organizations aren't the only victims. This attack vector is everywhere.
In healthcare: CareCloud. Aesto. AdaptHealth. Baylor Genetics. Nutex. AnMed. Each one a breach where a vendor's security failed and suddenly millions of patient records were exposed.
Outside healthcare: Shell. Amgen. Deutsche Bank. Lidl. The list keeps growing (list of all third-party breaches in 2026).
These aren't sophisticated attacks. They're not using novel exploits or cutting-edge techniques. They're compromising vendor credentials and walking through the front door because the front door has no locks.
The real question isn't whether this could happen to your organization. It's whether it's happening right now and you don't know it yet.
The Gap In Your Visibility
Ask yourself these questions. Try to answer them in the next 60 seconds:
Do you know which of your vendors accessed your systems in the last 48 hours?
Not who should have access. Who actually did.
Can you tell me what data they accessed?
Patient records? Billing information? Pharmacy data? API calls to your database?
Do you know if a vendor credential hasn't been used in 90 days but suddenly logged in last night?
This is a classic compromise indicator. Dormant accounts being reactivated. And you probably can't see it.
Do you know if a vendor has never actually logged in, but their credentials exist somewhere they shouldn't?
A credential that was created three years ago for a integration that never went live. Could be sitting in a shared password manager. Could be compromised. Could be actively being used right now by someone who shouldn't have it.
Do you know if a vendor's credentials appeared in a dark web breach last week?
There are thousands of credential dumps published every day. How many contain access to your systems?
Can you tell me if a vendor's normal login location just changed from Dubai to Romania?
Or from California to a botnet IP address? Or from your data center to a VPN exit node in Eastern Europe?
Do you know which vendors don't have MFA enabled?
This should be obvious. It probably isn't.
If you can't answer these questions with confidence, you have a gap. And gaps are where breaches live.
The Blind Spot Exists Everywhere
This isn't a failure of your security team. It's a blind spot that exists in every healthcare organization.
You secured the inside. Your firewall is hardened. Your network monitoring is comprehensive. Your SOC team catches threats on your perimeter. You did everything the security industry told you to do.
And then you handed 200+ vendors the keys and hoped they wouldn't lose them.
You didn't fail. You just didn't know there was a thing you needed to watch.
What Needs to Change
Vendor security isn't a trust problem anymore. It's an identity and visibility problem.
You need to know:
- Which vendors are accessing what, right now, in real time. Not what they should be accessing. What they actually are.
- Whether that access matches the pattern of life you established for that vendor. Is this normal behavior or anomalous?
- When a vendor account is being used by someone new or from somewhere unexpected. Has the access shifted from normal patterns?
- What data is actually flowing through those external connections. Not what should flow. What actually is.
Until you can answer these questions, you're not closing the gap. You're hoping someone else closes it for you.
And your patient data is too valuable for hope.
The Uncomfortable Truth
McKesson and Veradigm didn't get breached because their security was bad. They got breached because they had no visibility into vendor access patterns until after the data was already gone.
By the time they realized something was wrong, millions of patient records belonged to threat actors.
You probably have the same visibility problem. The difference is whether you find out from an internal audit or from a press release announcing that your data is for sale.
What Happens Next
The conversation in healthcare security needs to shift from "how do we trust vendors" to "how do we see what vendors are actually doing."
That shift requires a different approach. Not compliance scorecards. Not trust-based access models. Continuous visibility into vendor behavior patterns.
You need to see which vendors accessed your systems yesterday. You need to see what data they touched. You need to see if anything changed. You need to see it all in real time, before the breach becomes a press release.
This is no longer optional. It's foundational.
Take The First Step
If you can't answer the seven questions above, you have a gap.
The first step is visibility. We built an External Connection Audit that takes 15 minutes. We connect to your environment and show you what's actually flowing through your vendor integrations right now.
You'll see which vendors are accessing what. You'll see where they're accessing from. You'll see if any patterns look unusual. You'll see the gap that your current security can't see.
No implementation. No software. No disruption.
Just visibility into the thing that's been invisible.