LHC Group

LHC Group's breach traces to a single phone call: a vishing scheme talked one employee out of login credentials, and those credentials opened patient records with no further resistance. The attack vector was a voice, not a vulnerability, which means the trust boundary was a single person's judgment on a single afternoon. Clinical summaries, diagnosis codes, Medicare and Medicaid IDs, and in some cases Social Security numbers all sat behind that one login. If your entire security architecture can be defeated with a phone call, the attackers weren't brilliant, the system was built wrong.