Sweet-talking our way into patient data

A charming threat actor managed to talk their way into iRhythm Holdings' third-party applications, making off with sensitive patient health information and proprietary data. This delightful lapse in basic human skepticism affected patients whose private medical details are now leverage for a standard extortion demand. Safeguarding this sensitive data requires actually verifying identity before handing over the keys to the kingdom. Sadly, training staff to spot a basic trick remains an unsolved mystery in modern enterprise IT.