A call appears to come from the IT help desk. The caller knows an employee’s name and says there is a problem with their account. They direct the employee to a familiar-looking sign-in page. Within minutes, an attacker may have access to systems used to contact patients, coordinate visits, or store medical information.

This is a current healthcare threat. In September 2026, Health-ISAC warned that attackers were calling health sector employees, using look-alike domains, and moving from stolen credentials into connected cloud applications.

For Cybersecurity Awareness Month, three threats deserve attention from organizations that handle medical information and support clinical trials.

1. A convincing call can open several systems

Access to a central sign-in account may lead to email, shared files, patient contact platforms, and other connected services. Attackers moving from compromised identities into cloud applications to steal data and make extortion demands.

Employees need a response they can use under pressure. If someone calls claiming to be IT and asks for a password, verification code, sign-in approval, or a visit to a new login page, end the call and contact IT through a known number or channel. Report the attempt even if no information was shared. Security teams should be prepared to revoke sessions and investigate activity across connected applications.

For patients, an exposed contact system can reveal more than a phone number. It may show that someone expressed interest in a study, when they are available, or how to reach them. Patients should also have a reliable way to verify an unexpected study-related call through a number already provided by the study team.

2. Ransomware can interrupt care before the investigation is complete

An updated advisory from the FBI, CISA, and HHS identifies the medical sector among those affected by Medusa ransomware. These attacks can disrupt systems while criminals threaten to release stolen information.

In a clinical trial, an unavailable system might prevent staff from seeing tomorrow’s appointment list, a participant’s callback request, or instructions needed to coordinate a visit. Organizations should test how those tasks continue during an outage. Take one active study, assume its primary contact platform is unavailable for a day, and determine how staff would reach participants and route time-sensitive clinical questions.

Backups matter, but restoring a database does not answer every operational question. Teams also need an approved way to communicate during downtime and record actions taken before systems return.

3. Actively exploited vulnerabilities demand quick decisions

On September 27, CISA warned that attackers were actively exploiting two critical vulnerabilities in Citrix NetScaler products. Citrix released updates for affected customer-managed systems. This does not mean every healthcare organization uses the product; it shows how quickly a newly disclosed issue can become an operational decision for those that do.

When a critical system is affected, the organization must identify where it is used, determine whether it is exposed, apply the fix or other appropriate protective measures, and check for signs of compromise. That work may require a temporary interruption to remote access or another service. The patient support team needs to know the impact and have an approved way to keep participants informed.

A participant does not need the vulnerability number. They need to know whether a scheduled call or visit is affected, how to reach the study team, and whether any action is required of them.

This October, test three scenarios: a fake help-desk call, a day without the patient contact system, and an urgent security update that requires downtime. The results will show whether staff can respond quickly while keeping patients informed and their information protected.