An attacker called a Quantum Health employee on May 29, 2026, and talked their way onto the company's network. The attacker held that access for three days, and the intrusion surfaced only when systems went down on June 1.

Healthcare breach notices describe an incident like that as a phone call. Researchers tracking the same technique, voice phishing or vishing, say the sequence usually opens somewhere else, with a flood of email.

Most security programs handle inbox floods and suspicious phone calls in two different places. A July report from Zscaler ThreatLabz shows attackers running them as a single sequence, which changes what a defense has to catch and when.

One call gave an attacker three days inside Quantum Health

Quantum Health, a care coordination company based in Dublin, Ohio, was breached after an attacker contacted an employee by phone and, in the company's words, tricked them into providing access to the network. HIPAA Journal reported the details on August 17, roughly 11 weeks after the call.

The unauthorized access ran from May 29 through June 1, and files were acquired during that window. A network disruption on June 1 affecting internal and external systems is what put the company onto the intrusion. The breach was confirmed on June 8.

Exposed data includes names, addresses, dates of birth, Social Security numbers, diagnosis and treatment information, prescriptions, provider names, dates of service, and insurance and claims details. The number of affected individuals has not been publicly disclosed.

No ransomware group has claimed the attack. The tactics resembled those associated with ShinyHunters, a group known for working help desks to get around multi-factor authentication (MFA).

The chain starts in the inbox

Zscaler ThreatLabz published its analysis on July 27, covering a cluster of related campaigns it tracked from January through June 2026. The operator, which researchers call Helpdesk Hijackers, functions as an initial access broker: it establishes the foothold, then sells it to ransomware crews for the follow-on attack.

The sequence has several moving parts, and only one of them is a phone call.

Researchers assess that the initial compromise likely starts with spam bombing the victim's inbox. A Microsoft Teams message follows, from someone posing as IT help desk staff offering to sort out the mess. The employee is walked into opening a Quick Assist remote session, which is a legitimate Windows tool.

From there the attacker takes over. "After establishing a Quick Assist remote session on the victim's system, the threat actor launches a PowerShell command that downloads and executes GoGRPC," the researchers wrote. GoGRPC is a Go-based backdoor that communicates over gRPC on HTTP/2, letting its traffic blend in with ordinary web streams. ThreatLabz has cataloged four variants, each with more obfuscation than the last.

The flood does two things for the attacker. It gives the caller a credible reason to be calling, and it gives the employee a problem they want someone else to fix.

Paubox has documented the same playbook under two earlier operators. In Black Basta's STAC5143 operation, attackers sent 3,000 emails over 45 minutes before the target got a Microsoft Teams call from a fake Help Desk Manager.

Payouts King ransomware runs the same sequence, flooding the inbox to create urgency, then reaching the target on Teams as IT support and walking them into Quick Assist.

Read also: What is email bombing?

Vishing volume doubled in the first half of 2026

Healthcare IT leaders estimate that only 5% of known phishing attacks get reported to their security teams, according to Paubox survey data. An inbox flood that nobody reports strips out the one warning a security team would get before the phone rings.

The volume behind that gap is climbing fast. CrowdStrike data reported in CyberSecStats issue 71 on August 10 has vishing rates doubling between the second half of 2025 and the first half of 2026, following a 134% rise the year before.

The multi-channel structure shows up in the phishing data too. KnowBe4's Phishing Threat Trends Report Vol. 7 found that 17.38% of Microsoft Teams attacks now begin in the inbox to set the stage before migrating to Teams to deliver the payload. Teams-based attacks rose 41% in the six months from October 2025 to March 2026.

Fake calls account for 16% of Teams attack payloads, and IT is the most impersonated function in those campaigns. On the email side, 7.21% of phishing attacks in 2026 carry a malicious phone number, usually placed in a subject line, opening line, or attachment to move the target off email.

Why healthcare help desks are where this lands

Basic spam filters are the primary email defense at 65% of healthcare organizations, per Paubox survey data. A 3,000-message run in 45 minutes clears that kind of filter without much trouble.

Among healthcare IT leaders, 42% rate their organization's ability to quickly detect an email security breach as poor or very poor. Email-related security incidents already consume an average of 6 hours per week of IT staff time, so a spike in spam complaints competes with everything else in the queue.

Paubox research found 57% of healthcare organizations run email security training only once a year, and just 16% do it quarterly or more often. Annual training does not stay fresh through a call that arrives 10 months later.

Then there is the specific reason healthcare help desks are worth calling. The help desk can reset MFA, and in a clinical setting, "I cannot get into the EHR and I have a patient waiting" is a request nobody wants to slow down. The attacker gets someone with the authority to grant access and a reason to move quickly.

Go deeper: Lessons from ransomware gangs exploiting Microsoft Teams

How to defend the chain instead of the two halves

Treat an inbox flood as a security event

A sudden burst of subscription confirmations and newsletters aimed at one mailbox belongs in the security queue. Route it to whoever handles security alerts, and tell staff that reporting the flood matters as much as reporting a suspicious message.

Set the expectation that any IT contact arriving within a day of a flood is treated as unverified until proven otherwise.

Verify vishing calls out of band before any reset or remote session

Callers who reach the help desk should be verified through a channel they did not choose. Call back on the number in the directory, confirm through a manager, or require an existing ticket before any MFA reset.

The same rule works in reverse. When IT is the one calling a clinician, the clinician should have a documented way to confirm the call is real, since attackers impersonate IT more than any other function in Teams campaigns.

Restrict remote assistance tools by default

Quick Assist is the pivot point in both the ThreatLabz cluster and the Payouts King campaigns. Blocking or restricting it, along with similar remote tools, removes the step the whole chain depends on. Organizations that need it can allow it for a named group rather than the full user base.

Give inbound filtering something to read besides links

A bombing run is made of individually harmless email, and the impersonation that follows carries no attachment at all. Rules and reputation checks were not built for either one.

Paubox Inbound Email Security, included with Paubox Email Suite Plus and Premium, uses generative artificial intelligence (AI) to analyze tone, sender behavior, and message intent alongside sender reputation, attachment, link, and QR code scanning. ExecProtect blocks display name spoofing, which is how the follow-up message that appears to come from IT usually gets through.

Encryption still matters on the other side of an incident like this one. When an attacker does get valid access, the question becomes what protected health information (PHI) they can read and move, which is where HIPAA compliant email controls do their work.

Related: Vishing attacks targeting Okta identity systems are gaining momentum

FAQs

Is a vishing breach reportable under HIPAA?

Yes, when it results in unauthorized access to PHI. The entry method does not change the obligation, and the same HIPAA breach notification requirements apply.

Does MFA stop this attack?

Not on its own. The chain targets the people who can reset MFA rather than the MFA prompt itself, so a successful call produces valid credentials and a valid second factor. Verification procedures at the help desk are what close that path, alongside the access controls covered in enhancing HIPAA compliance with multi-factor authentication.

What is spam bombing and why does it come before the call?

Spam bombing floods a single mailbox with high volumes of legitimate-looking email, often by subscribing the address to hundreds of mailing lists. It buries real notifications, creates a problem the employee wants solved, and hands the attacker a plausible reason to call as IT support. Read more about how healthcare workers defend against email bombing attacks.