How Hackers Are Getting Into Senior Living Communities and What You Can Do About It

The most common way attackers breach organizations today has nothing to do with sophisticated malware or zero-day exploits. They log in. Identity-based attacks, where hackers use stolen or compromised credentials to access systems as legitimate users, are now the dominant attack vector across every industry, including senior living.

The Numbers Are Clear

In 2024, 67% of serious security incidents originated from stolen login credentials. Not software vulnerabilities. Not physical intrusions. Stolen usernames and passwords. The attackers did not break in. They walked in through the front door using keys they obtained through deception, theft, or brute force.

The MGM Resorts and Caesars Entertainment breaches in 2023 demonstrated how devastating this attack type can be at scale. In both cases, the attackers used social engineering to obtain employee credentials and then escalated their access to compromise entire enterprise networks. The attacks cost hundreds of millions of dollars in combined damages, downtime, and regulatory consequences.

How Identity-Based Attacks Work

• Fake emails and login pages. Attackers send emails that appear to come from Microsoft, Google, or internal systems. The email directs the recipient to a login page that looks identical to the real thing. When the user enters their credentials, those credentials go directly to the attacker.
• SIM swapping. Attackers contact the victim's mobile carrier and convince them to transfer the phone number to a new SIM card. Once they control the phone number, they can intercept Short Message Service (SMS) verification codes used for Multi-Factor Authentication (MFA). This is why SMS-based MFA is considered a weak form of second-factor authentication.
• MFA fatigue attacks. If an organization uses push-notification MFA, attackers repeatedly trigger authentication prompts on the victim's phone. After receiving dozens of unexpected prompts, some users eventually tap "Approve" just to stop the notifications. One tap is all the attacker needs.

Why Senior Living Communities Are Vulnerable

Senior living communities face a unique combination of risk factors. Staff turnover is high, meaning new employees who have not completed security training are regularly accessing systems. Many facilities use shared workstations where multiple staff members log in throughout the day. Clinical systems often run on outdated software with limited security controls. And the data at stake, resident health records and financial information, commands premium prices on criminal marketplaces.

Four Steps to Stop Identity-Based Attacks

1. Turn on MFA everywhere, using app-based authentication. SMS-based MFA is better than nothing, but it is vulnerable to SIM swapping. App-based authenticators such as Microsoft Authenticator or hardware security keys provide significantly stronger protection. Every account that accesses email, clinical systems, or administrative tools should require MFA with no exceptions.
2. Train your team to recognize social engineering. Phishing simulations and security awareness training reduce click rates on malicious emails by 50-70% when conducted regularly. Training should be role-specific: front desk staff, clinical staff, and administrators each face different attack scenarios.
3. Limit access to what each role requires. The principle of least privilege means every user account should have access only to the systems and data required for their specific job function. When an attacker compromises one account, limited access prevents them from reaching the most sensitive systems.
4. Use a password manager or go passwordless. Password managers generate and store unique, complex passwords for every account, eliminating password reuse across services. Passwordless authentication using biometrics or hardware keys removes the credential theft vector entirely. Both approaches are more secure and more convenient than expecting staff to memorize dozens of complex passwords.

The Perimeter Is No Longer the Firewall

Traditional security focused on keeping attackers outside the network perimeter. That model assumed a clear boundary between inside and outside. With cloud applications, remote work, and mobile devices, that boundary no longer exists. The new perimeter is identity. Every login is a potential entry point, and every account is a potential target. Organizations that protect identities as rigorously as they once protected firewalls will be the ones that avoid the next headline-making breach.