74% of Healthcare Email Breaches in 2025 Lacked Basic Authentication
Event summary
- 74% of healthcare organizations breached via email in 2025 lacked DMARC policies or had them set to monitor-only.
- Over half of breached organizations failed to verify sender authorization using SPF records.
- No breached organization enforced MTA-STS encryption between mail servers.
- Microsoft 365 accounted for 53% of breaches, up from 43% in 2024.
The big picture
The report highlights a persistent gap between recommended security practices and actual implementation, despite federal guidelines promoting DMARC, SPF, and MTA-STS. The concentration of breaches within Microsoft 365 users suggests systemic issues in platform adoption or user education. While total breach numbers decreased slightly, the worsening security posture of affected organizations signals ongoing vulnerabilities.
What we're watching
- Security Posture
- Whether healthcare organizations will prioritize foundational email security protocols despite the decline in total breach numbers.
- Vendor Responsibility
- How platform providers like Microsoft 365 will address the gap between available security tools and actual implementation by users.
- Regulatory Scrutiny
- The pace at which regulators may enforce long-standing recommendations for email authentication in healthcare.
Related topics