Credential Theft Fuels Disproportionate Healthcare Email Breaches in…

Event summary

Credential theft led to the most damaging healthcare email breaches in 2025, exposing over 630,000 patient records despite representing less than one-fifth of total email incidents.
Phishing-driven mailbox takeovers accounted for approximately 17% of email breaches but caused disproportionate harm by allowing attackers to remain undetected while searching for protected health information (PHI).
Vendor and business associate email exposure was the most frequent breach pattern, responsible for nearly one-third of all email incidents.
Executive and vendor impersonation emerged as a significant attack vector, with attackers spoofing trusted individuals to trick recipients into disclosing sensitive information.

The big picture

Healthcare data breaches continue to carry the highest average cost across all industries, with incidents involving third-party vendors averaging $4.9 million per incident. The urgency of healthcare workflows amplifies email security risks, making it difficult for staff to distinguish legitimate requests from sophisticated impersonation attempts. As long as phishing reaches inboxes, mailbox takeover will remain a significant threat.

What we're watching

Email Security Evolution: How healthcare organizations will adapt their email-layer security to detect and block phishing, impersonation, and spoofed identities before messages reach inboxes.
Regulatory Compliance: Whether the increasing frequency and severity of email breaches will prompt stricter regulatory measures for healthcare data protection.
Vendor Risk Management: The pace at which healthcare providers will implement robust security protocols for vendor and business associate communications to mitigate breach risks.