Talking smack about a doctor got him access to private medical files
A security researcher named Dahvid Schloss, hired to test a hospital's defences, gained access to a locked medical records room using nothing more than a fake badge and a bit of social engineering, rather than any technical exploit. The case, reported in The Register's weekly PWNED column, illustrates how human trust and workplace gossip can undermine even electronically secured facilities, and highlights broader weaknesses in healthcare security.
Schloss researched the hospital in advance, dressed in scrubs, made a non-functioning fake badge, and identified a real but unpopular doctor on staff. When his badge failed to swipe in, he complained to the on-duty nurse that "Dr Johnson" had failed to pull patient files needed for a trauma case, and she sympathised and let him straight into the records room, allowing him to retrieve the target file. He lingered afterwards to chat and reinforce his cover story before leaving. Schloss also found separate network security failures at hospitals, including one where guest Wi-Fi shared the same VLAN as critical medical devices such as MRI machines, exposing unencrypted patient data to anyone on the network.
In short
- Red teamer used a fake badge and fake gripe to enter a hospital records room
- Nurse let him in after he badmouthed an actual unpopular doctor
- Separate hospitals found sharing guest Wi-Fi with unencrypted medical device data
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Healthcare institutions must conduct thorough, realistic security testing to protect sensitive patient data and ensure patient safety. The vulnerabilities discovered—weak physical access controls and insecure network architecture—are genuine threats that malicious actors could exploit. Authorised penetration testing including social engineering realistically mirrors how real attackers operate, and only comprehensive testing can identify and remediate critical weaknesses before they cause harm.
The case against
Whilst security testing is justified and authorised, the methodology raises legitimate concerns. The approach required deceiving staff and implicating a colleague by falsely attributing clinical failures to them. More targeted testing—such as testing access controls independently of social engineering—could reveal similar vulnerabilities without employee deception or potential workplace damage.
Explained simply
A security researcher hired to test a hospital's defences managed to gain access to a locked medical records room through social engineering rather than any technical exploit. Dahvid Schloss posed as hospital staff, created a fake badge, and manipulated workplace trust to retrieve confidential patient files. The incident demonstrates how electronic security measures can fail when human judgment is compromised.
Schloss researched the hospital beforehand and identified an unpopular doctor working there. When his fake badge failed to open the records room door, he told the nurse on duty that the doctor had neglected to retrieve files urgently needed for a trauma case. Sympathising with the situation, she let him into the restricted area, and he reinforced his cover story with casual conversation before leaving.
The case illustrates a pattern of security failures extending beyond social engineering at healthcare institutions. Investigators discovered network security vulnerabilities at other hospitals, including guest Wi-Fi systems connected to the same internal network as critical medical equipment such as MRI machines. This meant unencrypted patient data was exposed to anyone able to access the wireless connection, highlighting how hospitals often prioritise convenience over information security.