One phone call was enough to give an attacker access to Quantum Health’s network.
Within days, files were stolen and internal and external systems were disrupted. The exposed data included Social Security numbers, diagnoses, prescriptions, insurance information, and claims data. The attacker used vishing, a phone-based phishing attack, to trick a user into providing access.
The same concern appears in different forms across the latest ColorTokens Threat Advisory. Stolen credentials, cloud applications, critical vulnerabilities, and operational technology can all provide a way in. What matters is how far that access can reach and whether critical systems and operations stay available.
Healthcare Breaches Are Still About More Than Data
Heart of America Medical Center found that an unauthorized third party had accessed its network and exfiltrated files containing patient information. The Embargo ransomware group claimed it stole around 800 GB of data. Precision Imaging Centers also reported unauthorized network access and copied files, with its investigation still underway.
Healthcare data remains valuable, but these incidents also put availability in focus. Patient care and clinical workflows depend on systems staying accessible during and after an incident.
Access the Forrester Wave™: Microsegmentation Solutions, Q3 2026 report. Learn why ColorTokens was the only vendor among the four Leaders to be rated “Superior” in the reporting and diagnostics, OT, IoT, and healthcare criteria.
Boston Scientific Shows What Downtime Can Really Cost
The medical device company identified a cyber incident on August 25, 2026. The disruption prevented access to certain operating systems and business applications and affected its ability to process and ship customer orders. Employees at manufacturing facilities in Cork, Ireland, were sent home because they could not work.
Boston Scientific operates in 127 countries, employs around 59,000 people, and makes products used to treat more than 48 million patients each year.
With order processing and shipments affected across a business of that scale, restoring operations is not always as simple as bringing a server back online. Manufacturing and tracking systems sit inside tightly controlled processes, and the data they produce has to remain trustworthy.
Trusted Access Can Become the Shortcut Attackers Need
American Addiction Centers found unauthorized access to its Salesforce environment and confirmed that data had been exfiltrated. Oculus Pathology found that a small number of employee email accounts had been accessed, exposing personal, financial, and health information.
The reported TheHatman campaign shows how that access can scale. Hudson Rock said roughly 3.6 million employee-directory records from nine companies were being sold after attackers allegedly reused stolen credentials tied to Microsoft Azure and Entra ID environments.
The report says the issue was not an Azure or Entra software flaw. The presumed attack path involved infostealer malware capturing passwords, browser sessions, or authentication tokens, followed by the attacker signing in with valid credentials and querying directory data. Three named companies later said their investigations found no evidence that employee data had surfaced on the dark web.
A valid login can give an attacker room to look legitimate. That puts more weight on how much access a single identity is allowed to exercise once authenticated.
Access the Best Practices Guide: AI Threat Resilience in the Age of Mythos
Critical Vulnerabilities Put Identity and Management Systems in Focus
CVE-2026-69836 in Microsoft Entra ID and CVE-2026-61241 in Oracle Internet Directory both carry a 10.0 severity score. The Entra ID issue could allow an unauthorized attacker to execute code over a network. The Oracle issue could allow an unauthenticated attacker with network access to compromise the directory service.
ServiceNow’s AI Platform also appears with CVE-2026-18885, another 10.0 vulnerability that could allow unauthenticated code execution in certain circumstances. Oracle Siebel CRM Cloud Applications carries a 9.9 vulnerability.
The report recommends reviewing vendor guidance, applying relevant updates, and assessing each vulnerability based on the organization’s environment, configuration, and exposure rather than the severity score alone.
Also Read: The CISO’s Guide to Containment in the Age of AI Attacks
Critical Infrastructure Turns Cyber Risk Into Uptime Risk
A small U.K. power facility was forced to shut down for four days after a cyberattack linked by officials to Iran-nexus hackers. Questions around attribution remain, and U.K. officials did not confirm whether programmable logic controllers were directly manipulated.
Programmable logic controllers from vendors such as Siemens, Rockwell Automation, and Schneider Electric have also been targeted in recent attacks. These devices control or monitor physical processes across sectors such as power, water, and manufacturing.
The report notes that nation-state adversaries accounted for 75% of 200 attacks against U.K. critical infrastructure over the previous 12 months.
For operational environments, breach impact can mean lost production, unavailable services, and days of recovery.
How Security Teams Can Reduce Breach Impact
- Assess vulnerabilities based on exposure, configuration, and business impact, not the CVSS score alone.
- Apply vendor patches and security updates after appropriate compatibility testing.
- Continuously monitor threat intelligence, official advisories, and new indicators of compromise.
- Strengthen identity, cloud application, email, and third-party access controls where compromised credentials can create trusted entry paths.
- Use microsegmentation and rapid isolation to prevent ransomware and other threats from moving laterally into critical systems.
- Review vendor oversight, internal procedures, and staff awareness where phishing, third-party platforms, or operational processes create exposure.
Across these incidents, the entry point changes, but the priority does not. Keep critical operations available and reduce how much of the business an attacker can affect after the first compromise.
Access the full ColorTokens Threat Advisory to review the breach details, critical vulnerabilities, and OT/IoT risks behind these incidents.
Get a free Breach Readiness and Impact Assessment to see where exposure sits, what to fix first, and where microsegmentation can reduce the spread.
