A criminal crew that chases healthcare data will follow it into any organization keeping employee medical files. Clinical paperwork described as psychiatric evaluations belonging to bureau staff is now circulating in a ShinyHunters extortion haul, the news agency Reuters reported on September 25 after reviewing the material. That marks a serious escalation from the job titles and assignment details the group had advertised days earlier.
ShinyHunters claimed the breach on September 22. Reuters reviewed the files, which the hackers circulated to a small group of journalists, and confirmed the clinical material was genuine. Former FBI operative Eric O’Neill told the news agency the presence of medical records pushed the incident toward the scale of the 2015 Office of Personnel Management intrusion, and predicted foreign intelligence services would try to buy the haul.
For healthcare security leaders the lesson is structural rather than political. Occupational health departments, employee assistance programs and benefits administrators hold psychiatric, addiction and disability records that carry the same sensitivity as patient charts, and they frequently sit outside the monitoring that covers the clinical network. A crew that lands in an enterprise file store can walk off with a workforce’s medical history without ever touching an EHR.
The FBI said it is “aggressively investigating” and declined to discuss the records. ShinyHunters has spent the past year running voice-phishing and single sign-on abuse campaigns against large enterprises, health systems among them, and has a habit of publishing data when negotiations stall.
What health systems should check
Map where employee health and wellness records live, confirm they sit under the same access controls and logging as clinical data, and require phishing-resistant MFA on every identity provider that fronts them.
