Ransomware access surfaced before patient data was touched

A healthcare organization relied on a claims processing portal protected by traditional multi-factor authentication (MFA).

Unit6 discovered that a ransomware-linked threat actor had obtained not only valid credentials for the portal, but also the MFA secret required to bypass authentication entirely.

The actor had already verified access and was preparing to move deeper into the environment.

Without intervention, the compromised account could have provided access to patient-linked financial records, claims data, and systems commonly targeted during ransomware operations.

Valid credentials, an MFA seed, tested access, and ransomware-related indicators

This discovery originated from Unit6’s external intelligence collection and actor monitoring capabilities rather than internal security alerts.

Working alongside the security team, Unit6 helped:

The organization also reviewed historical activity to ensure no data had been accessed and no persistence mechanisms had been established.

The attack path was eliminated before ransomware deployment or patient data exposure occurred.

The healthcare provider strengthened its identity security program, replaced vulnerable authentication methods, and gained confidence that a high-risk compromise had been neutralized before it became a reportable incident.