Every week, a healthcare organization discovers it has been breached. The forensics team reconstructs the timeline, the incident report identifies the entry point, and in case after case it is the same: a browser session. Not a misconfigured firewall, not an unpatched server — the same interface a clinician used to pull up a patient record, or a claims processor used to adjudicate a claim and update a member’s file. Your network tools see it as a valid HTTPS connection; your endpoint detection and response (EDR) never looks at it; your data loss prevention (DLP) was never designed to monitor it.
That browser gap is where Menlo Security’s 2026 Healthcare Security Brief focuses, and it is wider than most healthcare security teams realize, because the tools they trust most are the ones that cannot see it.
Here is what Menlo blocked across enterprise healthcare environments in Q1 2026 alone.
Credential phishing accounts for 58% of browser-based attacks in healthcare, one of the highest shares of any vertical — and in 2026 the dominant technique is no longer simple password theft. Adversary-in-the-Middle (AiTM) phishing intercepts the authenticated session token after multi-factor authentication (MFA) has completed. The attacker sits between the user and the legitimate service, captures the verified session, and arrives as a fully authenticated user. Resetting the password does nothing; the token is still live.
For a provider, that is a potential patient safety event: in 2024, an employee’s downloaded file led to ransomware that took Ascension’s hospitals offline and forced ambulance diversions (HHS OCR breach portal; Ascension public statement, 2024). For a payer, it is a path to claims fraud and large-scale member-data exposure. An attacker with authenticated access to a clinical workstation or claims system can observe, modify, and disrupt workflows, all without triggering a single alert. A January 2026 Phishing-as-a-Service (PHaaS) campaign against Microsoft 365 did exactly this: a page rendered correctly over HTTPS from a newly registered domain, with the token theft happening entirely inside the browser, below every network inspection tool.
Ransomware groups know healthcare cannot tolerate downtime. In 2024, the Change Healthcare attack, in which stolen credentials were used against a remote-access portal with no MFA, stalled claims processing nationwide for weeks and exposed roughly 190 million people, the largest health-data breach on record (HHS OCR breach portal; UnitedHealth Congressional testimony, 2024). Qilin, the most active ransomware operation globally in Q1 2026 (Check Point Research), uses browser-delivered credential theft as its primary initial access method. Phishing delivers the foothold, credentials are pulled straight from memory, and stolen sessions enable lateral movement through legitimate remote-management tools that raise no alerts. By the time encryption triggers, the initial access is four steps in the past, and the browser session where it started was never logged.
Fifty-four percent of ransomware victims had their credentials exposed in infostealer logs before the attack began (Verizon DBIR 2025).
In a single healthcare customer environment, Menlo observed 276,000 file uploads to GenAI tools in a 30-day period — most with no policy, no visibility, and no governance. This is not an edge case: the 2025 Verizon DBIR found 15% of employees use generative AI from corporate endpoints at least once every 15 days, 72% signing in with personal email, creating data flows that bypass every enterprise DLP control. When a clinician pastes protected health information (PHI) into ChatGPT, or a claims processor pastes member PII into a browser-based tool, it generates no alert, no log entry, and no compliance signal.
HIPAA audit controls require that you account for PHI transmission. Browser sessions are transmission events — and for most healthcare organizations, there is no accounting for them.
In February 2026, a user at one of the nation’s largest healthcare organizations clicked an email link to what looked like an Adobe secure document portal. The domain was clean. Zero vendors flagged it on VirusTotal at time of click, and no reputation-based tool in the stack flagged anything wrong. But what the page was actually doing differed from what it claimed: it was requesting the download of a trojanized remote-management tool disguised as a PDF. Had the user run it, the attacker would have had persistent remote access to a clinical workstation — able to observe, modify, and disrupt patient-care workflows with no alert anywhere in the stack.
Menlo blocked the file by analyzing what the page was attempting to do, not where it came from. That gap between what a page claims to be and what it actually does is where modern healthcare attacks now live — and none of the tools that said “clean” were built to close it.
Healthcare teams have invested well — network controls, endpoint protection, email gateways, DLP — and those tools perform exactly as designed. But none were built to operate at the browser layer, where credentials are entered, sessions live, data moves, and AI agents now act on behalf of clinical and claims-processing staff. Closing that gap takes capabilities your existing stack does not have:
Download the 2026 Healthcare Security Brief →
Menlo Security
