In July 2025, the U.S. Department of Health and Human Services’ Office of Inspector General (HHS-OIG) released a cybersecurity audit of a large Northeastern hospital.

The findings revealed a sobering truth: even hospitals with robust defenses, like firewalls, disaster recovery, and security training, remain vulnerable if basic configuration and authentication controls are not consistently enforced.

To provide the technical testing for this audit, OIG engaged BreakPoint Labs (BPL) to conduct penetration testing, web application reviews, and vulnerability scanning under a signed Rules of Engagement. Our work demonstrated how minor weaknesses in internet-facing systems can escalate into significant risks to patient safety and data integrity.

Why This Matters for Healthcare

Healthcare providers remain at the center of the cyber threat landscape.

• 48+ breaches a month → In July 2025, HHS’s breach portal logged 48 reportable incidents; August saw 55. Combined, these affected 8M+ patients, with more than 80% tied to hacking or IT intrusions
         
• Ransomware dominates → Incidents fell from 222 in 2021 to 61 in 2024, yet ransomware still drives 39% of all breached healthcare records. The Change Healthcare breach alone (~190M records) disrupted the entire sector.
      
• High costs and lasting impact → Healthcare remains the most expensive industry to breach, at $7.42M per incident, with an average lifecycle of 279 days (IBM, 2025). In the Change Healthcare case, 74% of hospitals reported experiencing delayed care, and 94% suffered financial harm, with a third losing half of their revenue.

Together, these numbers reinforce the OIG’s audit findings: healthcare is too often playing defense against adversaries who only need to find one overlooked gap.

Key Findings from the Audit’s Technical Testing

The OIG audit validated that many of the hospital’s defenses were effective. Employees successfully resisted phishing attempts, and the web application firewall blocked most malicious traffic. However, BPL’s technical assessment identified exploitable weaknesses that highlight where hospitals remain at risk:

• Authentication exposure: 2 of 26 systems had weak identification and authentication controls, enabling unauthorized access.
  
  
• Account discovery: 16 of 255 systems leaked username information through error messages, aiding password attacks.
  
  
• Web application misconfigurations: All 13 apps tested had integrity or configuration flaws, including unnecessary connections to external systems and insufficient input validation.
  
  
• Pivot risk: Although no patient data was directly compromised, the weaknesses could have been used as launch points for deeper intrusions.
  
  

OIG’s Recommendations — and the Hospital’s Response

OIG issued five recommendations, all accepted by the hospital:

• Enforce stronger configuration and change management.
  
  
• Implement stricter authentication controls (e.g., secure password policies, MFA).
  
  
• Conduct regular vulnerability assessments.
  
  
• Apply secure coding standards such as OWASP.
  
  
• Hold vendors and contractors to the same standards as internal systems.
  
  

Your 30/60/90-Day Action Plan

Hospitals and healthcare organizations can use this roadmap to harden their defenses quickly:

Days 0–30: Close Obvious Gaps

• Eliminate username discovery on login portals.
  
  
• Enforce MFA for remote and admin access.
  
  
• Lock down unnecessary system functions and services.
  
  
• Patch exposed systems and apply secure baseline configs.
  
  

Days 31–60: Prove Controls in Practice

• Conduct a web application security tune-up (error handling, input validation, secure defaults).
  
  
• Run a purple-team exercise to test defenses against OIG-style attacks.
  
  
• Implement structured vulnerability management with SLAs.
  
  

Days 61–90: Make Security Durable

• Require security impact analyses before new/vendor systems go live.
  
  
• Establish continuous testing (quarterly external reviews, annual pen tests).
  
  
• Enforce a developer secure coding policy aligned with OWASP.

How BreakPoint Labs Can Help

As OIG’s trusted technical partner in this hospital audit, BreakPoint Labs brings proven expertise in offensive security testing tailored for healthcare environments. Our services help you proactively identify and fix the same types of vulnerabilities found in this engagement.

Our healthcare cybersecurity services include:

• Authentication Hardening Sprints – eliminate account discovery, enforce MFA, and strengthen password policies.
  
  
• Web Application Security Tune-Ups – remediate coding, configuration, and logic flaws.
  
  
• External Attack Surface Reviews – monitor and validate internet-accessible systems.
  
  
• Purple-Team Exercises – simulate attacker tactics to validate defenses.
  
  

Cybersecurity is patient safety. Don’t wait for an audit to find your blind spots.

Request a consultation with BreakPoint Labs today, and let’s build a perimeter-hardening plan that works.

Note: This post summarizes lessons learned from an OIG audit without naming the hospital or exposing sensitive details. Recommendations are sector-wide best practices suitable for public use.

https://oig.hhs.gov/documents/audit/10493/A-18-22-08019.pdf

BreakPoint Labs engineers had a great time this past weekend at BSidesJXN 2017 held at the Bomgar facility in Jackson, MS. Our engineers gave a talk titled “Adding Pentest Sauce to Your Vulnerability Management Recipe” – all about improving vulnerability management based on Red Team tips and tricks. BSidesJXN is a great example of why we love BSides events – strong and friendly community of information sharing. Check out their website for some more information and consider attending next years event.

The motivation for the talk came from common pentest findings that are missed during vulnerability scanning and management. The goal was to supply a vulnerability analyst with some tips and tricks from the red team to help them secure their environment. The slides for the talk are below and cover ten tips for improving vulnerability management: