Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare

1. Break the attack chain between vishing and SSO account takeover by requiring out-of-band identity verification for all password resets, MFA resets, and device re-enrollment requests (e.g., call back using a previously verified phone number, require manager approval for privileged accounts). 2. Implement a 'no same-call' helpdesk policy — reset requests must be submitted via a support ticket and require a verified callback before any changes are made. 3. Apply additional verification requirements for high-risk users: executives, IT administrators, security personnel, and finance employees. 4. Deploy phishing-resistant MFA (FIDO2 or WebAuthn security keys) for admins, helpdesk, executives, and other high-risk groups. 5. Disable or tightly restrict SMS and voice-based authentication. Require a managed device or conditional access policy for registering new MFA factors. 6. Treat SSO systems as 'Tier 0' critical assets: require MFA and compliant devices for sensitive cloud service access, block legacy authentication, detect sessions with improbable geographic changes, and limit admin portals to managed devices. 7. Centralize identity and SaaS audit logs; monitor for new MFA registrations, newly enrolled devices, suspicious OAuth grants, unusual API activity, and bulk file downloads. 8. Restrict API tokens and third-party integrations; require approval for access to sensitive data. 9. Ensure incident response teams can quickly revoke active sessions, reset credentials, and disable malicious OAuth applications. 10. Over the next 30–60 days, prioritize phishing-resistant MFA for high-risk users, strengthen helpdesk reset procedures, enforce conditional access policies, and test the ability to contain compromised cloud accounts.