Assume the credentials are already stolen: which clinical controls still work

The useful way to read an infostealer statistic is not as a warning but as a change of assumption. If credentials for your clinical systems are already on a marketplace, then every control that begins by trusting a credential has already been evaluated — and failed. The remaining question is which controls are still standing.

Part of Hospital and clinical identity

The statistic, and what it does and does not say

2026 threat intelligence reporting found that roughly three-quarters of infostealer-infected devices in the sampled corpus carried credentials for electronic health record or clinical portal systems. Separately, stolen-credential email compromise was named the driver behind the most damaging healthcare breaches of the preceding year, and US healthcare breach volume ran at hundreds of reported incidents in the first half of 2026.

Read the sampling frame before you use the number. These figures come from the telemetry of vendors who see infected machines; they describe the population of compromised devices, not the population of all devices. The correct inference is not 75% of clinicians are compromised. It is when a healthcare-adjacent device is compromised, clinical credentials are usually among the loot. That is still a decisive planning assumption.

Why the standard response does not work

The reflex is dark-web monitoring plus forced password reset. It has two structural problems.

First, modern stealers take browser cookies and tokens alongside passwords. A valid session cookie replays cleanly against a system that authenticated once and then trusts the session. The attacker never performs a login, so multi-factor authentication at login is not bypassed — it is simply not invoked.

Second, mass resets generate helpdesk volume, and helpdesk volume is itself an attack surface. Every reset cycle produces a window in which identity-verification staff are under pressure and a social engineer is statistically likelier to succeed. You can spend a control and buy an exposure.

A password reset is a revocation of one artefact in a theft that took several.

The five capabilities to score against

To evaluate controls honestly, fix the adversary's capability set first. These five are documented, commodity, and available to any operator buying logs rather than running malware themselves.

1. C1 — Password theft. Stored and typed credentials for any application.
2. C2 — Cookie and token theft. Live session material replayable without authentication.
3. C3 — Seed and OTP capture. Software authenticator seeds, and one-time codes relayed in real time through a proxy.
4. C4 — Device fingerprint cloning. User agent, canvas, screen and locale characteristics reproduced.
5. C5 — Behavioural mimicry. Operating within normal hours from residential proxy space in the right geography.

The Control Survivability Matrix

A control survives a capability if the attacker holding that capability still cannot complete the consequential action. Abbreviated to the rows that matter; the full 22-row version follows the same method.

The pattern is not subtle. Everything that authenticates a login fails against C2, because C2 does not involve a login. Everything that infers legitimacy from signals fails against C4 and C5, because those capabilities exist precisely to reproduce signals. Only a control that requires a fresh cryptographic act, bound to the specific action, at the moment of the action, survives the column set.

The metric nobody tracks

Health systems track infection counts, reset counts, and phishing click rates. The variable that actually governs loss is none of those. It is time from exfiltration to effective revocation — the interval during which stolen material still works.

Estimate yours with a base-rate approach. Infostealer logs typically reach a marketplace within days of infection. Your detection is usually triggered by a monitoring service, and your revocation is usually a password reset that does not touch sessions. If session lifetimes are measured in days and session revocation is manual, the honest answer is often weeks.

Publish that number internally before proposing anything. It reframes the entire conversation from prevention, where you are losing, to containment interval, where you can measure progress.

Where to apply the surviving control

Per-action assertion is expensive in the only currency clinicians care about — seconds — so applying it universally is both unnecessary and self-defeating. Scope by consequence:

• Controlled substance prescribing and dispensing actions.
• High-alert medication administration.
• Bulk export of patient records, which is the action most often implicated in exfiltration.
• Changes to payment or remittance destinations in revenue-cycle systems.
• Privileged elevation and credential reset inside the identity platform itself.

That list is deliberately short. It covers the actions where a replayed session converts into real-world harm, and leaves ordinary clinical work untouched.

The leading indicators to watch

If you want to know whether this assumption is getting better or worse over the next eighteen months, three indicators move first:

1. Adoption of device-bound session credentials in mainstream browsers, which would move C2 from fails to survives for a large class of controls.
2. The share of clinical applications supporting origin-bound credentials natively rather than through a portal wrapper.
3. Whether infostealer log pricing for healthcare-tagged corpora rises or falls, which is a rough proxy for supply.

None of these is under your control. The interval between exfiltration and revocation is. Start there.

Control-by-control, under the assumption

Run this exercise for your own environment and the list of surviving controls is usually very short. That is the finding, and it is more useful than a maturity score.

Objections and honest limits

“We have strong endpoint protection.” Which reduces the probability of theft and does not change what happens after. The exercise assumes the outcome you are trying to prevent, which is the point.

“Gating clinical actions will slow care.” Gating everything would. Gating the set that is both irreversible and attractive — controlled substance orders, bulk record export, credential changes — touches a small fraction of clinical activity.

Running the assumption exercise

1. Assume credentials are stolen. Not a hypothetical — a starting condition.
2. List every control and ask whether it fires. Most will not.
3. Identify the actions that matter. Irreversible, attractive, or both.
4. Gate those with a fresh bound assertion. The only control that survives the assumption.

Terms used here

Infostealer

Commodity malware harvesting credentials and session material, traded in bulk.

Assumed compromise

A design approach that begins from the attacker already holding valid credentials.

Step-up

A fresh authentication bound to a specific action, rather than reliance on the session.

Frequently asked questions

Does this mean MFA was a waste? No. Multi-factor authentication at login eliminated a large class of credential-stuffing and simple phishing attacks, and the matrix shows it still survives password theft. The narrower point is that it is not invoked when an attacker replays a stolen session, so it cannot be the last line for consequential actions.

How do we know if our sessions have been stolen? Usually you do not, which is the planning problem. Treat session compromise as a standing assumption for high-consequence actions rather than an event to be detected.

Is endpoint detection not the answer? Endpoint detection reduces infection rate, which is valuable and worth funding. It does not change what happens after a device that was not covered — a personal machine, a contractor laptop, a home device used for portal access — is compromised.

What is the smallest useful pilot? One action class, usually bulk record export, on one system. Measure the gesture time, the user complaint rate, and whether the receipt survives an internal audit walkthrough.

Which controls survive a stolen session? Only those requiring a fresh gesture the attacker cannot produce. MFA at login, role-based access and audit logging all fail the test.

Does endpoint protection change the answer? It reduces the probability of theft. The exercise assumes theft has happened, which is what makes it useful.

Won't gating slow clinical care? Gating everything would. The set worth gating — controlled substance orders, bulk export, credential changes — is a small fraction of activity.

Sources and further reading

• ONC / ASTP health IT certification and safety resources
• Bureau of Industry and Security — Export Administration Regulations
• FCC — protecting consumers from SIM swap and port-out fraud
• Documented adversary-in-the-middle and session-replay techniques in public threat research.
• W3C Web Authentication Level 2
• CISA — cybersecurity advisories
• 45 CFR §164.312 — HIPAA Security Rule technical safeguards