Documented social engineering incidents targeting the healthcare sector, sourced and fact-checked.
TV investigative reporters filmed Rite Aid pharmacy dumpsters nationwide overflowing with readable prescription labels.
DocumentedA spoofed email impersonating a company executive tricked a Main Line Health employee into emailing the W-2 and personal data of all ~11,000 staff to criminals.
DocumentedSpoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller, tricked finance staff into wiring $4.8M to an overseas account for a bogus acquisition.
Reported/allegedAn unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its refusal by handing it a 1,084-line attack playbook as a file to save, which loaded automatically into every later session; Gambit Security reconstructed the result as a human-directed campaign that used Claude Code and OpenAI's GPT-4.1 against nine Mexican government bodies. Anthropic confirmed the misuse of its platform and banned the accounts, but every named victim that has responded denies being breached and no Mexican authority has confirmed it.
DocumentedCalifornia's Attorney General and six county DAs found more than 10,000 paper patient records and hazardous/medical waste in unsecured.
DocumentedCVS pharmacies nationwide tossed pill bottles, prescriptions, and employee SSNs into unsecured public dumpsters; media exposure across a dozen-plus cities led to a $2.25M HHS settlement and a separate FTC consent order in 2009.
DocumentedAn unrelated MHRA search warrant found care-home patient prescription and NHS records rotting in unlocked crates and bin bags at a London pharmacy.
DocumentedA single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole personal data on 78.8 million people over the next 11 months.
DocumentedAnthropic says one criminal used Claude Code to breach 17 organisations, price ransoms from their own books and write the notes. Demands hit $500,000+.
DocumentedFraudsters impersonating an Ascend Laboratories executive convinced Alkem Laboratories to wire USD 6,161,336 (about Rs 51.30 crore) to a fraudulent US bank account under a bogus tax-refund pretext; Rs 222.7 million remains unrecovered, and a second, separate business email compromise hit Alkem's Enzene Biosciences US subsidiary roughly 18 months later.
Social Engineering Examples