Forgotten Accounts: A Growing Healthcare Security Risk
Updated: Sep 30
You probably know every server in your building. But do you know every login that can get into your patient records system?
Most hospitals can't answer that. And that's exactly the gap attackers look for.
New equipment brings hidden logins with it
Every time you connect a new machine — an infusion pump, a patient monitor, a lab device — it usually comes with its own login just to make it work: one for the vendor's technician, one to connect it to your systems, sometimes a shared password on the workstation next to it.
These get set up quickly during installation, often with more access than they really need, just to get everything running on time. Then the technician leaves, and nobody checks on that login again. It's never changed. It has no extra protection. And often, no one is even responsible for it anymore.
Over the years, this adds up — staff who moved departments, vendors whose contracts ended, old systems that were replaced but never fully shut down. The logins stay behind, quietly connected to your network.
This is already happening to hospitals in the Philippines
Healthcare is now the most targeted industry for cyberattacks in the Philippines, according to a CYFIRMA (2026) report. Attackers go after hospitals because medical records sell for far more than other stolen data (CYFIRMA, 2026).
Stolen logins were behind close to 1 in 5 healthcare ransomware attacks last year, and many hospitals admitted they simply didn't have enough staff to catch it happening in time (Sophos, 2025).
Rules are getting stricter too. Under recent guidance from the National Privacy Commission, hospitals now have only five days to report a breach in full. Five days to figure out which login was used and what it could access — something that normally takes weeks of manual checking.
The real risk? The accounts that are more powerful than anyone realizes
Most IT teams can list who has admin access. Very few can tell you which "ordinary" accounts could be used to reach admin access — through old permissions, forgotten settings, or accounts that were never cleaned up.
That's the dangerous part. A leftover vendor login with no obvious red flags could still lead an attacker straight to full control of your systems.
A free 2-day check to see exactly where you stand
BeyondTrust offers a short, no-cost assessment that connects to your existing systems (like Active Directory, Entra, or Okta) and shows you, within 24–36 hours:
Every account in your environment and what it can access
Which accounts could be misused to gain more control
Old or forgotten accounts still active
Missing protections like multi-factor authentication
Clear, prioritized recommendations to fix what's found
It takes under an hour to set up, and about 3–5 hours of your team's time in total. No cost, no obligation.
Want to see what's really in your environment?
Request for a free assessment now or send us an email at inquiries@serviceitplus.com to inquire.
Spots for the free assessment are limited. Have basic details about your systems (AD, Entra, Okta, etc.) ready — qualifying only takes a short call.
