Healthcare's latest attacks often start with a phone call: someone posing as IT support calls an employee or the help desk and talks them onto a lookalike login page. Health-ISAC's Q3 2026 Health Sector Heartbeat, published October 21, attributes most of the quarter's rise in health-sector incidents to these ShinyHunters domain impersonation campaigns.

Q3 2026 also set a ransomware record. Health-ISAC counted 317 ransomware events against the health sector, 9.72% of the 3,260 it tracked across critical infrastructure and above healthcare's historical average of 7.5%.

Healthcare's share keeps climbing

In Q2, which Paubox covered in July, healthcare made up 7.51% of the events Health-ISAC tracked, and that quarter's count was already an all-time high. Q3 passed it by more than 100 events.

How the ShinyHunters campaigns work

Health-ISAC writes that "this surge in attack volume is largely attributed to the effectiveness of recent ShinyHunters domain impersonation campaigns harvesting organizational credentials, directly driving the overall rise in incidents."

According to the report's threat actor profile, operators research employees and departments, then call them from spoofed internal phone numbers while posing as IT support. The caller steers the employee to a lookalike login page, often on a personal phone outside corporate security controls.

A reverse-proxy phishing kit relays the password to the real login portal in real time, while the caller coaches the employee into reading out an MFA code or approving a push notification. Operators also call help desks directly to ask for MFA resets, new device enrollments, or password resets.

ShinyHunters credential-phishing domains were one of Health-ISAC's two main alert themes in Q3. Recent domains follow patterns like company-claims[.]com and company[.]claims, some with medical themes. A Health-ISAC threat alert on ShinyHunters vishing and domain impersonation reported campaigns against multiple member organizations over a two-week stretch in August, with the scope widening across business units.

Related: Health-ISAC warns healthcare of ShinyHunters identity-based attacks

One stolen session can expose every app behind single sign-on

After the attacker holds an authenticated session, the single sign-on platform (Microsoft Entra, Okta, or Google) becomes their route into every connected application. Health-ISAC describes fast data theft from Microsoft 365, SharePoint, and Salesforce.

The report notes that ShinyHunters "does not typically deploy ransomware or encrypt files." Systems keep running, so a victim may notice little operational disruption while PHI and other organizational data are already gone.

For a compliance officer, the HIPAA breach assessment after this kind of incident depends on proving which records the attacker reached, so you need quick access to identity and SaaS logs. Backups and downtime plans usually do little here.

Health-ISAC's top fixes start at the help desk

Health-ISAC's mitigation list leads with people and process:

  • Phishing-resistant MFA (FIDO2/WebAuthn keys or passkeys) for administrators, help desk staff, and executives, with SMS and voice fallbacks turned off
  • Verified callback and strict identity checks before any MFA reset, with no same-call resets
  • Training staff that IT will not reset MFA on an inbound call
  • Blocking .claim and .claims domains unless you need them, and watching new domain registrations for lookalikes of your SSO login page
  • Alerts on bulk downloads, OAuth consent changes, and MFA reset events

For a smaller organization without a dedicated security team, the help desk changes usually cost the least. A written rule that the help desk calls back a known number before any reset, and never resets MFA during the same call, takes the help desk step out of this campaign's playbook.

The report also points members to HHS's Health Industry Cybersecurity Practices (HICP), free guidance for organizations of every size.

Email carries part of the campaign

The calls happen outside email, so no mail filter will see them, though the setup work shows up in email: Health-ISAC's most frequently observed technique in Q3 was registering new domains (77 indicators), followed by creating lookalike or compromised email accounts (75) and harvesting corporate email addresses (65).

The report also describes malicious links delivered by email, SMS, and Microsoft Teams, along with "email bombing followed by help desk impersonation," where an inbox flood comes before a call from fake IT support.

Paubox inbound email security includes ExecProtect+, which blocks lookalike-domain email impersonating colleagues, IT staff included, on the email side of a campaign like this one. It does not stop a phone call or a help desk reset, so it works alongside the callback rule and phishing-resistant MFA rather than in place of them.

If you are reviewing email controls after this report, the guide to HIPAA compliant email covers encryption, authentication, and HIPAA safeguards for inbound and outbound mail.

Go deeper: How to stop phishing attacks before they reach your team