Healthcare and biotech breaches rarely look like a Hollywood hack. They look like a login.
In the two largest cautionary tales of the past few years, attackers did not defeat a firewall or burn a zero-day, they walked in with a valid credential and let the platform's own design do the rest.
This guide walks how these platforms actually get breached, the entry points attackers use, grounded in the Change Healthcare and 23andMe cases, and how testing that reads the code catches the failures that decide how far a breach spreads.
Common Questions About Healthcare And Biotech Data Breaches
The demand here is about understanding and prevention, and the questions are consistent.
How do healthcare data breaches actually happen?
What was the largest one, and how did it start?
How did attackers reach millions of genetic profiles at 23andMe?
Why are these platforms targeted so heavily?
How do you actually prevent it?
Why Healthcare And Biotech Platforms Are Top Breach Targets
These platforms sit on exactly the data attackers want, concentrated and valuable. A healthcare platform holds protected health information, and a biotech or genomics platform adds something rarer, genetic data that is permanent and cannot be reissued the way a password or a card number can.
The economics reflect it. Healthcare has been the costliest breach category for more than a decade, with the average breach now above 10 million dollars, and 2025 alone saw hundreds of millions of patient records exposed across the sector.
The concentration is what makes a single platform so damaging. One healthcare processor or genomics service holds data for tens of millions of people, so a single breach exposes them all at once, which is why attackers target the platform rather than each patient.
How The Change Healthcare Breach Happened
The Change Healthcare breach of February 2024 is the clearest example of how these incidents actually unfold, and it became the largest healthcare breach in US history. The mechanics were ordinary at every step.
It began with a valid login. A ransomware affiliate used compromised credentials on a Citrix remote access portal that lacked multi-factor authentication, and the company's CEO later told Congress that the missing MFA was the vulnerability that allowed the attack to succeed.
A single stolen password was all it took to get in.
From there the blast radius came from what the access could reach. The attackers operated undetected for nine days, escalated privileges, and moved laterally, because weak monitoring and a lack of internal segmentation let a low-level account reach critical systems.
They exfiltrated several terabytes of data and deployed ransomware, ultimately affecting roughly 190 million people and halting claims and pharmacy processing for a large share of the country.
How The 23andMe Genomics Breach Happened
If Change Healthcare shows how a missing control cascades, 23andMe shows how an application feature can do the same. In 2023, attackers reached the genetic profiles of roughly 6.9 million people without ever breaching the company's core systems.
The entry point was credential stuffing. Attackers took passwords leaked from unrelated breaches and tried them against 23andMe accounts, and because the platform did not require multi-factor authentication at the time, roughly 14,000 accounts fell, less than 0.1 percent of the user base.
The amplification is the lesson. Those 14,000 accounts had opted into the DNA Relatives feature, which let one account view profile data for genetically connected users, so the attackers scraped outward from each compromised account to reach roughly 6.9 million people, with no effective safeguards against automated scraping and months before detection.
The UK regulator later fined the company, its reputation collapsed, and it filed for bankruptcy, a reminder that with genetic data, once it is out, it cannot be changed. A separate genomics firm, Vitagene, drew FTC action after genetic information was left exposed, setting a precedent for enforcement in the sector.
Healthcare And Biotech Breach Entry Points
Across these cases and the wider sector, breaches enter through a small set of predictable doors. Naming them is how a health-tech team scopes real risk.
Stolen and reused credentials. The front door in both cases above, a valid login from a password leaked elsewhere or bought from an infostealer log.
Missing multi-factor authentication. The single control whose absence turned a stolen password into a national incident at Change Healthcare.
Application and feature abuse. Features that expose connected data, like DNA Relatives, and APIs that return records without checking ownership, which amplify one account into many.
Weak monitoring and detection. Nine days undetected at Change Healthcare, months at 23andMe, giving attackers time to spread.
Poor segmentation and lateral movement. A low-level account reaching critical systems because the network trusted it too far.
Cloud misconfiguration. Patient or genetic data left exposed in storage that was never locked down, as in the Vitagene case.
Third-party and supply chain. A breach of one vendor or integration cascading into the platforms that depend on it.
The Breach Pattern: Valid Login, Weak Access, Large Blast Radius
Step back and the same shape repeats. Attackers do not usually hack in, they log in, and the size of the breach is decided by what that access can reach rather than by the login itself.
The initial credential is hard to prevent entirely, phishing, reuse, and infostealers will always land some access. What separates a contained incident from a mega-breach is the application and identity layer behind the login, whether MFA gates the portal, whether an account can move laterally, whether a feature or an API hands out other people's records.
That layer is where the blast radius is set, and it is where testing pays off.
How Healthcare And Biotech Platforms Can Prevent Data Breaches
Because initial access is hard to eliminate, the defense that works is hardening what that access can reach, and a test built to walk the same path an attacker walks finds the gaps first. That is what a penetration test does for a health-tech platform.
Reconnaissance maps the exposed surface the way an attacker sees it, the internet-facing portals, the authentication that gates them, and the credentials already leaking on the open internet, which is exactly how the Change Healthcare entry point would surface. From there, the workflow tests whether an account can move laterally, whether a feature or API exposes connected records, and whether tenant and patient data stays isolated, chaining minor findings into a proven path to ePHI.
The failures that matter most are in authorization. The amplification that turned 23andMe from a small login attack into a genomic mega-breach was, at its core, an access control problem, one account reaching data it should never have seen, and that is precisely the class of flaw a code-aware test is built to catch.
What To Test On A Health-Tech Platform To Prevent Breaches
The practical scope for a software-driven health or biotech company is the application and cloud layer, where patient and genetic data is most exposed. A credible test reaches the parts an attacker would.
The priorities are the multi-tenant data model and the APIs on top of it, the patient and researcher portals and their authentication, the features that expose connected records, the bulk export paths, and the cloud identity and storage configuration. Reading the code across black, white, and gray box modes is what confirms whether an endpoint or a feature checks ownership before returning data.
One honest scope note. A code-aware test hardens the software, cloud, API, and portal layer thoroughly, and it complements rather than replaces identity controls like enforced MFA and specialized hardware or firmware testing for physical devices, which belong in the broader security program alongside it.
How Code-Aware Continuous Testing Reduces Healthcare Breach Risk
The exposure on a health-tech platform changes with every release, and a single annual test cannot keep up. New portals, APIs, and features each open new paths, and most of them ship between annual engagements.
Continuous, code-aware testing closes that gap. It re-examines the ePHI-handling surface on every change, so a new feature that exposes connected data or an API that skips an ownership check gets caught as it ships, not a year later.
The walkthrough of how AI penetration testing traces a data leak shows a full chain, and the evidence feeds directly into a HIPAA risk analysis.
Reading the code is what makes the difference. The authorization and feature-level flaws that decided the blast radius in both cases above live in the application logic, and a test that reads that logic finds them where a black-box scan cannot.
How CodeAnt AI Tests Healthcare And Biotech Breach Paths
CodeAnt tests the ePHI-handling parts of a health-tech platform the way an attacker would, continuously. It maps the exposed surface, proves whether an account or a feature can reach data it should not, and ships a working proof of exploit with the remediation and retest evidence a security team and a regulator both expect.
Because it runs on every change, the platform's exposure is validated as it evolves, so the feature shipped last week is tested this week rather than at next year's engagement. Findings map to your HIPAA requirements and overlapping frameworks, with the code path behind every finding.
The pricing suits a growth-stage health-tech budget. Testing is outcome-based, a zero engagement fee with payment only on confirmed critical findings, so continuous coverage of a regulated platform does not mean a large fixed bill.
Conclusion: Reduce The Blast Radius Before A Login Becomes A Breach
Healthcare and biotech platforms get breached through the ordinary, a reused password, a portal without MFA, a feature that exposes connected records, an API that never checks ownership. The initial access is almost mundane, and the damage comes from what that access is allowed to reach.
Both mega-breaches make the same point. Change Healthcare turned one missing control into 190 million records, and 23andMe turned 14,000 logins into 6.9 million victims, and in each the blast radius was set by the application and identity layer, not the front door.
That is the layer CodeAnt tests, code-aware and continuous, proving whether a stolen credential reaches one record or millions, priced on what it finds.
Launch a free black box scan for one URL to see your exposed surface the way an attacker maps it, then book a walkthrough to see continuous testing chained through to a proven data leak. For the compliance side, start with our guide to HIPAA penetration testing requirements.
