Full Report
Toothless security
Analysis Summary
# Incident Report: The "Toothless Security" Zombie Admin Account
## Executive Summary
A security audit of a dental practice revealed a dormant administrative account belonging to a third-party scheduling contractor that had remained active for three years after the business relationship ended. The account provided unauthorized access to 4,000 patient records, creating a significant HIPAA compliance risk and a "backdoor" for potential exploitation. The issue was remediated by a security consultant who implemented new vendor offboarding policies and bi-annual access reviews.
## Incident Details
- **Discovery Date:** Approximately 2025 (Last year relative to article date)
- **Incident Date:** 2021 (Start of unauthorized access) – 2024/2025 (Discovery)
- **Affected Organization:** Unnamed Dental Practice
- **Sector:** Healthcare
- **Geography:** USA
## Timeline of Events
### Initial Access
- **Date/Time:** 2021
- **Vector:** Valid Third-Party Credential
- **Details:** A scheduling contractor set up a secret administrative account to perform their duties but failed to disclose its existence to the office manager.
### Lateral Movement
- **Details:** Not applicable in a traditional sense; the account was created with persistent administrative privileges, allowing direct access to the patient database without further movement required.
### Data Exfiltration/Impact
- **Details:** No evidence of malicious exfiltration was reported; however, 4,000 patient records (PHI) were exposed and accessible to unauthorized entities for three years.
### Detection & Response
- **Discovery:** Found during a security audit conducted by Chris Kirksey (CEO of Direction).
- **Response Actions:** The consultant identified three unauthorized admin accounts and immediately revoked their access.
## Attack Methodology
- **Initial Access:** Valid Account (Contractor/Vendor)
- **Persistence:** Account Creation (Secret admin account left active post-termination)
- **Privilege Escalation:** Not required; the account was granted Admin rights at creation.
- **Defense Evasion:** Account was "undisclosed," meaning it did not appear on the office manager’s known user list.
- **Credential Access:** Stored/active credentials in the patient database system.
- **Discovery:** Not applicable (Attacker-side); the account sat dormant.
- **Lateral Movement:** N/A
- **Collection:** Access to 4,000 patient records.
- **Exfiltration:** Potential for exfiltration existed for 3+ years.
- **Impact:** HIPAA compliance vulnerability and data exposure risk.
## Impact Assessment
- **Financial:** Potential for heavy HIPAA fines due to unauthorized access to Protected Health Information (PHI).
- **Data Breach:** Exposure of 4,000 patient records.
- **Operational:** Low (Discovered during routine audit; no system downtime).
- **Reputational:** High risk if the exposure had been exploited or reported as a formal breach.
## Indicators of Compromise
- **Behavioral indicators:** Administrative accounts linked to defunct vendors/contractors; accounts with no login activity for extended periods but retained high-level permissions.
## Response Actions
- **Containment:** Immediate deletion of the three identified unauthorized admin accounts.
- **Eradication:** Removal of the contractor's "secret" access point.
- **Recovery:** Implementation of a "Vendor Offboarding" protocol and a bi-annual access review policy.
## Lessons Learned
- **Visibility Gap:** The office manager was unaware of which accounts existed in their own database, highlighting a lack of administrative oversight.
- **Shadow IT:** Contractors may create accounts for convenience that do not follow official onboarding/offboarding workflows.
- **Zombie Accounts:** Decommissioning a vendor relationship must include a technical audit of permissions, not just a termination of the contract.
## Recommendations
- **Inventory Management:** Maintain a comprehensive list of all users and service accounts with administrative privileges.
- **Vendor Offboarding Checklist:** Ensure that "Account Revocation" is a mandatory step when any third-party contract ends.
- **Periodic Access Reviews:** Conduct bi-annual or quarterly audits of all system accounts to identify and prune "zombie" accounts.
- **Principle of Least Privilege (PoLP):** Ensure contractors are only given the minimum level of access required for their task, and ensure all created accounts are documented.