By Lucy Peters
The healthcare industry has long been a favored target for cybercriminals. In 2024, the industry faced more cyberthreats “than any other critical infrastructure industry,” an American Hospital Association News article highlights the findings of the Federal Bureau of Investigation’s Internet Crime Report for that year. Ransomware is just one major threat, though these aren’t the only cyber-risks that the healthcare industry faces. While many may recognize common cybersecurity terms like ransomware and malware, social engineering threats can feel less familiar despite their potential for massive security disruption. Typically cloaked in a clever disguise, these cyberattacks largely depend on a victim’s human nature to attack and obtain access to valuable data, underlining an extra sinister side of cybersecurity that all professionals must be aware of.
The unsettling nature of social engineering
Many may conjure up an image of a lone hacker behind a cyberattack, furiously typing away as they unlock sacred information. Armed with elite skill and high-level know-how, bad actors are often depicted as “evil geniuses.” While this may be how some breaches occur, attacks that stem from social engineering utilize a much more unsettling approach. Rather than fall back on computer science know-how and hardcore skill, bad actors often use tactics that play on a victim’s human nature in order to achieve their goal.
There are a number of different ways that social engineering can drive a cyberattack through to success. Phishing is a majorly popular way that social engineering is put to work to extract valuable information from victims, often making use of specific wording that helps play into human psychology by appealing to a person’s emotions. An email from an illegitimate source that states an account is in danger and that action “must be taken now” is just one example in which a phishing scam may involve malicious social engineering. Business email compromise, or BEC, is another common type of social engineering strategy, in which hackers often trick victims by pretending to be a valuable figure within the company itself, from vendor to manager or even the CEO. BEC threats often use stolen yet legit credentials in order to pass through security measures, ultimately making these types of scams sophisticated and financially damaging in nature.
An IBM Think article titled “What is social engineering?” further explores the many faces in which such threats may take form, and why it often works out for cybercriminals. Aside from phishing, social engineering may take the form of ‘scareware,’ the article describing it as a sort of malware that induces fear into the victim, ultimately persuading them to share sensitive information or take an equally dangerous action. Another form highlighted by the article is ‘pretexting,’ in which a cybercriminal may tailor a scenario that caters to the victim and points to a sort of resolution via something that may look like “click here to resolve.” The IBM article goes on to point out that nearly every social engineering attack utilizes some sort of pretexting, making it necessary for professionals to understand how to identify in real-world application. Cybercriminals tend to find success in social engineering methods due to their simple yet manipulative nature. IBM explains this concisely: “They manipulate victims’ emotions and instincts in ways proven to drive people to take actions that are not in their best interests,” the article states.
The ramifications — a closer look
The healthcare industry is exceptionally connected, from sensitive patient records to financial information. While this makes it a “perfect” target for cybercriminals, it also illustrates the striking amount of damage that any attack can have. One 2025 TechTarget article by Jill Hughes highlights a number of some of the largest healthcare data breaches that were reported that year, all of which listed involved “hacking or IT incidents.” First listed is the Yale New Haven Health System, or YNHHS breach, which happened to impact 5,556,702 individuals and involved a “multimillion-record” breach. According to the article, an investigation by YNHHS brought to light that an “unauthorized third party had gained access to its network.” It’s important to note that while the breach did not involve any electronic medical records, vast amounts of personally identifying information were involved, underlining a significant concern for patients across the board.
Outside of the most commonly known risks associated with sensitive data and financial consequences, healthcare organizations and their patients can be affected in ways that may be less obvious upon first thought. Operational disruption or a strained infrastructure within a facility, for example, can heavily impact the patient experience. In addition to schedule disruption and long wait times, patients may fail to receive the care they may need at the moment, causing them to go elsewhere. Reputational damage is another major point of concern, as patients are likely to lose trust in a facility that falls victim to an attack — especially if it was preventable from the get-go.
While operational disruption wreaks havoc on the facility, professionals themselves may discover a variety of shortfalls in the meantime. Short-staffed and often made to rely on manual practices throughout an attack, healthcare workers can become overly stressed and overwhelmed, which can make one more prone to human error while on the job. A lack of preparedness on the facility’s part can lead to even more chaos, especially should employees feel unprepared or downright lost during a cyberattack. On the flip side, those that fall victim to a social engineering attack may face additional fallout. Based on the situation, an employee may require retraining, face investigation, and even disciplinary action. In some cases, an accidental incident may cause a facility to rethink their training altogether, instead opting to retrain the staff in an improved way.
Preparation will always set the tone
Social engineering threats are intimidating, however, every healthcare professional plays a critical part in their prevention. Training is a major part of this, as education is crucial for employees to understand the risks and how to identify them straight on. However, in conjunction with the importance of upholding such knowledge and best practices, the healthcare industry plays a critical and powerful component in cybersecurity as a whole.
Preparation in the form of foundational security measures is an essential for any healthcare entity — while employees can be properly trained, threats can be complex and can continue to evolve. As such, developing an industry-wide mindset that accepts that human error or a high-tech threat may one day become a reality can be a great way to approach security framework measures. With this mindset, the industry can be more proactive with a vigorous security system that thinks ahead, rather than lags behind. A 2025 MSSP Alert article by Faisal Misle highlights several beneficial recommendations for healthcare organizations. Among the suggestions include the implementation of multi-factor authorization, the strengthening of email systems, and even the enlistment of an AI-driven threat detection system. Other suggestions include a comprehensive response plan, as well as routine training to maintain consistency. When coupled with other measures like routine security audits, healthcare organizations can take charge and adapt as necessary.
The unsettling nature of social engineering threats can make for a challenging security environment in healthcare. Through impactful training and foundational security measures, the healthcare industry can buckle down and proactively prevent threats.
Author bio
Lucy is a freelance writer who enjoys contributing to a range of publications, both in print and online. She spent almost a decade working in the care sector with vulnerable people before taking a step back to start a family and now focuses on her first love of writing.
Please also review AIHCP’s Health Care Management Certification program and CE Courses see if it meets your academic and professional goals. These programs are online and independent study and open to qualified professionals seeking a four year certification
Written by Doris Huber.