Having a mailbox at the center of a breach results in more patients being affected than other email attacks would. When a mailbox falls into the wrong hands, all the data stored there is exposed. Past patient results and attachments are accessible to them as well. After getting hold of the credentials, they can access all the emails exactly as that person would.

In the article The top 3 healthcare email attacks in 2025 and how to defend against them from Paubox, we took a closer look at 170 email breaches that were reported to the US Department of Health and Human Services (HHS). The report linked approximately 17% of these breaches to mailbox takeovers. More than 630,000 people were exposed, a figure the article called "the most damaging email attack type by impact."

Should this apply to you and your HIPAA compliant email, it's worth taking seriously. Beyond that one email, a thief can also get their hands on the patient information inside it.

 

Treat the mailbox as a record store

In the same way a misdirected email exposes patient information, a mailbox takeover gives them access to everyone's details in that email. But when it comes to a mailbox takeover, they can view any of those patients who were in the emails that person received. The Paubox report's section on mailbox takeover describes attackers reviewing historical email for protected health information (PHI) and attachments, then searching for billing, referral, or lab-related keywords.

Imagine an employee at an orthopedic practice whose mailbox holds three years of referrals. Those lab results and referrals could all wind up being delivered to that email address. And they should be, since they're allowed to share that information. According to an HHS FAQ they "do not expressly prohibit the use of email for sending e-PHI."

 

Compare incident share with patient count

Looking at the data, vendor and business associate emails occur more frequently than mailbox takeovers. This makes sense, since vendors working with your facility outnumber your employees.

Across all email-related breaches in 2025, roughly 2.5 million patients had their information exposed. If you narrow it down to mailbox takeovers, they account for 630,000 of those patients. So it accounts for about one-sixth of incidents but close to a quarter of exposed patients.

When an organization uses incident volume to set its priorities, chances are you'll give mailbox takeovers less priority than they actually warrant.

 

Recognize why a valid login goes unnoticed

The Paubox article states that "phishing is the attack point. Inbox access is the objective." They will take the login information from an email that your employee fell victim to and be able to log in. All of your security will think that it's just that person logging into their email.

They may even set inbox rules to redirect or not show certain emails. This could make it harder for you to detect that someone else has access to that mailbox. If there was an inbox rule created to send any email with the word lab in it to another email address. That could go undetected for who knows how long.

Email encryption will not help you in this situation. You can receive an encrypted email and open it as if the patient wasn't in it. Because your employee logged into their account, they can see all the information that was sent to that mailbox.

 

Expect some phishing emails to be clicked

Research suggests a successful phish is largely a matter of volume. A JAMA Network Open study of phishing in the health care sector found that employees clicked almost 1 in 7 of the simulated emails.

Another Journal of Medical Internet Research study looked at what factors may play into an employee clicking on a phishing email. They found that having too much to do was a contributing factor. They may be so busy that they don't have time to look at an email properly. This can be the case at the end of the month for prior authorization or even just Monday morning.

 

Contain the spread to colleagues and partners

Not only can they steal patient information from that one mailbox. But they can also use that email to send malicious emails to others. Since it's coming from a real co-worker's email address. They may not see any red flags that it isn't from that person.

One move they could make is sending an email asking others to collaborate on a document. From there, it could be sent to every employee and medical provider you work with. If a cybercriminal seized your practice manager's email account, they would be able to do the very same thing.

Paubox has a feature called ExecProtect+ that can help you stop malicious emails from coming from similar domain names or from compromised email accounts.

Read also: Actions to take following a mailbox compromise

 

Count patients the way the breach rule does

Just like when you have an impermissible disclosure of PHI, there are certain rules you need to follow if someone gained access to those emails. One of them is whether the PHI was acquired or viewed. If you don't have the ability to see which emails were viewed by that hacker, you will most likely have to notify all of those patients who were in that mailbox.

You may also notice more patients once you are digging through the files to see which patients were in there. As seen with Saint Anthony Hospital, they originally thought 6,679 patients were affected when, in reality, 146,108 were.

 

FAQs

Is a mailbox takeover a reportable HIPAA breach?

A takeover of a mailbox holding unsecured PHI is presumed to be a breach unless a documented risk assessment shows a low probability of compromise.

 

Does encrypted email prevent a mailbox takeover?

No, encryption protects messages in transit and at rest, while an attacker using stolen credentials reads them as the signed-in user.

 

Does multi-factor authentication stop mailbox takeovers?

MFA makes a stolen password harder to use, but the Paubox report lists treating it as a backstop among common failures, so it works best alongside inbound filtering and mailbox monitoring.