A hired security tester socially engineered a hospital nurse to unlock a restricted medical records room, despite having a non-working fake badge. He used a believable story, referenced a real doctor’s name, and built rapport by complaining about that doctor to convince the gatekeeper to let him in. The story highlights how friendly, “I belong here” behavior can bypass physical controls and lead to exposure of sensitive medical files.
A hired security tester posed as a brand-new hospital employee. He wore scrubs and carried a fake security badge that could not possibly swipe in at the door. When the badge failed, he did not walk away. Instead, he leaned into a pretext: a named doctor on staff was allegedly failing to pull records needed for a trauma case, and he had been sent to retrieve them urgently.
The nurse gatekeeping the restricted records room responded to the story, and to the shared frustration about the doctor's behavior, by opening the door and letting him in. Once inside, he retrieved a targeted patient file. Rather than leaving immediately, he stayed and talked with the nurse for another ten minutes, complaining about security being incompetent, which further normalized his presence.
Several factors combined to make this pretext effective:
Defenders in healthcare settings should treat these signals as warning signs:
Organizations can reduce the risk of this kind of physical social engineering by reinforcing that appearance and confidence are not proof of authorization. Staff should be trained to treat a non-working badge as a trigger for a documented verification process, such as contacting security or a supervisor, rather than manually opening restricted doors. Even in situations framed as urgent or life-or-death, access to sensitive areas like medical records rooms should require verified identity. Building this habit reduces the chance that a friendly, confident pretext alone can bypass physical access controls.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
He wore scrubs, carried a fake badge that could not actually swipe in, and used a story about an urgent trauma patient's records to convince a nurse to open the door for him.
He built rapport by name-dropping a real doctor on staff and complaining about that doctor, which lowered the nurse's suspicion and made the request feel legitimate.
Treat a non-working badge as a red flag and follow a documented verification process, such as calling security or a manager, rather than manually opening a door.
This case is associated with MITRE ATT&CK technique T1656, impersonation, used to gain physical access to a restricted area.
A guy in scrubs, fake badge that doesn’t even swipe… still walks into a restricted records room. He swipes, it fails, he sighs and says, “Look, I’m gonna save you the details. Dr Johnson’s being an absolute asshole, didn’t pull the trauma records. I’m brand new, they sent me to grab the file.” She says, “I got you,” badges the door for him, and he walks straight to a patient file. Then he hangs out, chatting another ten minutes so it feels normal. That’s social engineering, not teamwork. Here’s the move: if someone’s badge doesn’t work, you do not be the hero, call security or your manager and let them handle the door.
A cyberattack disrupted University of New Mexico Health hospitals, forcing ambulance diversions and canceled clinical appointments. During the incident, attackers reportedly played a synthetic voice message on hospital workers’ computers claiming they had stolen sensitive data and directing…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
Threat groups are actively targeting healthcare and pharma staff using phone-based social engineering (“vishing”) and look‑alike medical domains to steal employee login credentials. Researchers say attackers pressure employees to click password-reset or MFA-reset links, and multiple…
Astrana Health disclosed that attackers stole private and confidential data after using social engineering to trick employees. The attackers impersonated Astrana personnel and spoofed the company’s main phone number to contact staff, leading to unauthorized access to servers and data exfiltration.
