Talking smack about a doctor got him access to private medical files

A red-team engagement recounted how an attacker used social engineering—posing in scrubs and feigning frustration with a doctor—to convince a nurse to let him into a hospital records room and remove a patient file. The piece also reports dangerous network practices at other hospitals, including medical devices placed on the guest VLAN and sending unencrypted PII over the network, exposing patients to potential data theft.