INDUSTRY FACT FILE · HEALTHCARE & HEALTHTECH

Five New Case Studies in Healthcare Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in healthcare and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Ransomware That Closed the OPD 3.  Case Study 2: The Lab Report Portal That Listed Everyone 4.  Case Study 3: The Teleconsult App That Logged Too Much 5.  Case Study 4: The Infusion Pumps on the Guest Wi-Fi 6.  Case Study 5: The Health Records Pulled Without Consent

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in healthcare with the obligations that apply in India as of October 2026—in particular the DPDP framework, CERT-In's Directions, ABDM and the Telemedicine Practice Guidelines.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Ransomware That Closed the OPD	Multi-specialty hospital	Ransomware across a flat network	CERT-In; DPDP	B7, B10, B8
2. The Lab Report Portal That Listed Everyone	Diagnostic network	Insecure direct object references in report links	DPDP; CERT-In	B2, B6, B7
3. The Teleconsult App That Logged Too Much	Telemedicine provider	Health data shared through third-party SDKs	DPDP; Telemedicine Guidelines	B2, B6, B9
4. The Infusion Pumps on the Guest Wi-Fi	Hospital chain	Medical IoT on a shared network	CERT-In; Medical Devices Rules	B3, B1, B7
5. The Health Records Pulled Without Consent	Digital health platform	Consent checks bypassed in a records integration	DPDP; ABDM policies	B2, B6, B4

It started at the billing counter. It ended with patients sent elsewhere.

At a glance
Organisation	A 400-bed hospital (“Hospital A”) with HIS, LIS and PACS on one network
Threat	Ransomware spreading from a billing PC to clinical servers
Why it is new	Flat networks turn one infection into a hospital-wide outage
Codec Networks services	Managed SOC, ransomware readiness, incident response (Bundles B7, B10, B8)

The scenario

A billing clerk opened a malicious attachment. The attacker moved across Hospital A's flat network to reach HIS, LIS and PACS servers.

Systems were encrypted early on a Monday. Registration, lab results and imaging stopped, and staff switched to paper.

Emergency patients were diverted. Hospital A had to report to CERT-In within six hours while restoring systems.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• No segmentation between admin, clinical and device networks.
• EDR alerts were not monitored 24x7.
• Backups were online and partly encrypted.
• Downtime procedures were outdated.

The impact

Hospital A faced days of disruption, patient diversion, recovery costs and scrutiny of patient data exposure.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.
• Accreditation and contracts: continuity expectations of accreditors, insurers and schemes.

How Codec Networks would help

Need	Codec Networks response	Bundle
Detect early	24x7 SOC with EDR	B7
Prepare to recover	Segmentation, backup and downtime drills	B10
Respond	Ransomware response and recovery	B8

Key lessons Segment clinical networks. Monitor around the clock. Keep backups offline and tested. Practise downtime procedures.

Every patient's report was one number away.

At a glance
Organisation	A diagnostic chain (“Lab B”) sending report links by SMS
Threat	Sequential report IDs allowing bulk download of reports
Why it is new	Convenience links often skip authorisation
Codec Networks services	Portal and API testing, data protection, monitoring (Bundles B2, B6, B7)

The scenario

Lab B sent patients SMS links to download reports. The links used sequential IDs and required no login.

An attacker wrote a script to iterate IDs and downloaded thousands of reports, including sensitive test results.

Some reports appeared on a public forum, and Lab B had to notify patients and investigate.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Predictable report IDs.
• No authentication or expiry on links.
• No rate limiting or bulk-download alerts.
• The portal was never security-tested.

The impact

Lab B faced reporting obligations, patient complaints, reputational damage and DPDP exposure once breach provisions commence.

The regulatory lens

• CERT-In Directions: data leaks reported within six hours.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.
• SPDI Rules: reasonable security practices for medical records until replaced.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the portal	Authorisation and object-access testing	B2
Protect reports	Patient data protection programme	B6
Watch downloads	Bulk-access monitoring	B7

Key lessons Use unguessable, expiring links. Require authentication. Rate-limit and alert on downloads. Test portals before launch.

The app worked well. Its analytics worked too well.

At a glance
Organisation	A telemedicine platform (“Platform C”) with a popular consultation app
Threat	Symptoms and prescriptions captured in analytics events shared with advertising platforms
Why it is new	SDKs quietly expand where health data goes
Codec Networks services	App and SDK privacy testing, DPDPA review, vendor assessment (Bundles B2, B6, B9)

The scenario

Platform C embedded several analytics and marketing SDKs to track app usage.

Event names and parameters included symptoms, specialities consulted and prescribed medicines.

A privacy researcher showed that this data reached advertising platforms, prompting complaints and app store scrutiny.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• SDK data flows were never reviewed.
• Health data was included in analytics events.
• No data minimisation policy for telemetry.
• Notices did not explain the sharing.

The impact

Platform C removed SDKs, updated notices, faced complaints and lost user trust.

The regulatory lens

• DPDP Act and Rules: notice, lawful processing and safeguards once provisions commence.
• Telemedicine Practice Guidelines: privacy expectations for teleconsultation.
• App store policies: health data handling rules.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the app	Mobile app and SDK privacy testing	B2
Fix the data flows	DPDPA review and minimisation	B6
Assess SDK vendors	Third-party SDK assessment	B9

Key lessons Review every SDK's data flow. Keep health data out of analytics. Minimise telemetry. Explain sharing clearly.

The malware wasn't aimed at the pumps. It found them anyway.

At a glance
Organisation	A hospital chain (“Group D”) with connected infusion pumps and monitors
Threat	Malware from a visitor's device disrupting device management servers on a shared network
Why it is new	Devices on flat networks inherit everyone else's risk
Codec Networks services	IoMT segmentation, device testing, monitoring (Bundles B3, B1, B7)

The scenario

At one Group D hospital, device management servers and some connected devices shared a network segment reachable from guest Wi-Fi.

Self-spreading malware from an infected visitor laptop reached the device management servers and disrupted them.

Nursing staff lost central monitoring for several hours and reverted to manual checks.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Devices shared a network with guest traffic.
• No complete device inventory.
• Device servers ran outdated software.
• Device network traffic was not monitored.

The impact

Group D conducted a clinical risk review, redesigned its network and accelerated a medical IoT programme.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• Medical Devices Rules: device safety expectations and coordination with manufacturers.
• Accreditation: patient safety and equipment management.

How Codec Networks would help

Need	Codec Networks response	Bundle
Segment devices	IoMT network segmentation review	B3
Test devices	Device and management server testing	B1
Watch devices	IoMT monitoring	B7

Key lessons Keep devices off shared networks. Inventory every device. Harden device servers. Monitor device traffic.

Onboarding was faster. Consent was optional.

At a glance
Organisation	A digital health platform (“Platform E”) integrating with a health records exchange
Threat	Records fetched without a valid consent for users who had not agreed
Why it is new	Consent is the control at the heart of health data exchange
Codec Networks services	Consent-flow testing, DPDPA review, compliance assessment (Bundles B2, B6, B4)

The scenario

To speed onboarding, Platform E's developers implemented record fetching that did not always wait for a valid patient consent.

Records were retrieved for users who had never approved sharing.

An audit flagged the pattern, the integration was suspended and Platform E had to delete the data and explain its controls.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Consent was not enforced on every fetch.
• Purpose limitation was not checked.
• Fetches were not logged against consent records.
• Integration was not tested before launch.

The impact

Platform E lost integration access temporarily, faced regulatory questions and damaged partner trust.

The regulatory lens

• ABDM policies: consent-based exchange and data management obligations for participants.
• DPDP Act and Rules: lawful processing and consent once provisions commence.
• CERT-In Directions: reporting of related incidents within six hours where applicable.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the integration	Consent-flow and API testing	B2
Fix governance	DPDPA and health data governance review	B6
Prove compliance	Compliance assessment and audit-ready records	B4

Key lessons Enforce consent on every fetch. Check purpose before access. Log fetches against consent. Test integrations before go-live.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com