How to Respond to a SIM Swap Attack Involving an Imaging Modality Log Server

A SIM swap can give an attacker control of a phone number and let them intercept text-message verification codes. If that number is tied to a healthcare worker’s accounts, the attack may become a route into systems that support imaging, including an imaging modality log server. Treat the phone takeover and any suspicious system access as a coordinated healthcare incident response—not as a phone problem alone.

Act promptly, but coordinate cybersecurity containment with clinical and imaging leaders. A suspected incident does not, by itself, establish that patient information was accessed or that a reportable breach occurred; investigate the facts and assess notification duties.

How do you contain a SIM swap and recover the phone number?

Use a trusted device and a contact method that is not the compromised number. Contact the wireless carrier through a verified number or official website, report the suspected SIM swap fraud or port-out, and ask it to restore your number to your authorized SIM or device. Ask the carrier to block further SIM changes or number transfers while the incident is investigated.

Set or replace the carrier account PIN or password, review recent account changes, and request available account protections and alerts. Record when you lost service, when you contacted the carrier, and any case or confirmation numbers. The Federal Trade Commission’s SIM swap guidance recommends contacting the carrier promptly and notes that text-message verification may not stop a SIM swap.

Do not rely on text-message codes sent to the affected number until the carrier confirms you have regained control. Once the number is secure, change passwords for accounts that use it for recovery or multifactor authentication, revoke unfamiliar sessions, and replace SMS verification with an authenticator app or security key where supported.

Which accounts and systems should be secured first?

Prioritize accounts that could let an intruder reset other credentials or reach clinical systems. Start with the carrier account and the affected user’s primary email, identity provider, remote-access tools, privileged administrator accounts, and password manager. Then review accounts and connections that can reach the imaging modality log server, such as VPN, domain, cloud, vendor-support, and hospital network accounts.

• Use a known-clean device and a trusted authentication method to reset credentials.
• Revoke active sessions, refresh tokens, app passwords, and recovery methods the attacker may have added.
• Disable or reset compromised accounts and credentials; review administrator and service accounts for unauthorized changes.
• Check sign-in and account-change records for unfamiliar devices, locations, password resets, MFA changes, and access outside normal work patterns.
• Review log server access controls and restrict access to authorized personnel while preserving a safe path for incident responders and clinical operations.

SMS-based multifactor authentication can be vulnerable when an attacker takes over the phone number. The FTC recommends stronger options, such as an authenticator app or security key, for accounts where those methods are available.

How do you investigate and preserve imaging modality log server evidence?

Notify your security or incident-response team, privacy officer, IT operations, imaging leadership, and relevant vendors under your organization’s response plan. Establish a timeline beginning before the phone stopped working. Compare carrier notices and account changes with identity-provider, VPN, network, server, and imaging modality audit logs.

Preserve relevant records before routine retention or rotation removes them. Collect available authentication and access logs, administrator activity, configuration changes, alerts, and records from connected imaging systems and services. Include the time range, time zone, collection method, system, and person who collected each item. Keep originals protected, limit access to investigators, and document transfers and actions taken.

Do not clear, edit, or overwrite logs during initial response. If collection could affect system operation, coordinate with the system owner, vendor, and forensic responders. CISA advises organizations to protect logs from unauthorized access or deletion and retain them according to applicable policies; its incident-response guidance also emphasizes preserving data that may be volatile or have limited retention.

Determine what the server logs contain and whether they identify patients, examinations, user activity, or access to protected health information. Correlate log-server activity with PACS, RIS, modality, and identity records where available. A log entry may show that an account or system was accessed, but further analysis may be needed to determine what information was viewed, changed, exported, or disclosed.

When should affected systems be isolated?

Isolate an affected account, device, server, or network segment when evidence indicates ongoing unauthorized access or a material risk that the attacker can continue moving through the environment. Choose the narrowest effective action—such as disabling a compromised account, blocking a malicious remote-access path, or restricting server connectivity—when that can contain the threat without unnecessarily disrupting patient care.

Coordinate isolation with the incident commander, IT or security team, imaging leaders, clinical engineering, and the modality or log-server vendor. Before disconnecting or powering down equipment, consider whether doing so could affect active examinations, patient safety, evidence collection, or device integrity. If immediate isolation is necessary to prevent further harm, follow the organization’s emergency procedures and document the decision and its clinical impact.

HIPAA’s Security Rule requires covered entities and business associates to have procedures for identifying and responding to suspected or known security incidents, mitigating harmful effects where practicable, and documenting incidents and outcomes. See the HHS summary of the HIPAA Security Rule.

How can clinical teams maintain essential imaging operations?

Activate the organization’s downtime or emergency operations plan if normal access to the log server or connected systems must be restricted. Imaging leaders should identify which services are essential, what systems remain safe to use, and whether examinations can be redirected to another scanner, department, or facility. Communicate the approved workflow to ordering clinicians, radiology staff, and the incident-response team.

Use only organization-approved alternatives. Depending on the environment and the incident, these may include a validated downtime process, an alternate system, or a controlled manual workflow. Record studies and operational decisions so they can be reconciled when systems are restored. Do not bypass access controls or reconnect an isolated system without authorization from the response team.

HHS describes contingency planning under the Security Rule as including backup and recovery procedures and plans to continue critical business processes while operating in emergency mode. See HHS guidance on Security Rule contingency planning.

What reporting and recovery steps are required?

Document the incident, containment decisions, evidence collected, systems assessed, and recovery approvals. Before restoring access, verify that compromised accounts and sessions have been addressed, suspicious changes have been reviewed, and the security team has approved the affected systems for return to service. Monitor for renewed account changes, unusual authentication, and unexpected log-server activity.

Have the privacy officer and legal counsel assess whether unsecured protected health information was impermissibly accessed, used, or disclosed. Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the organization demonstrates a low probability that the PHI was compromised through the required risk assessment or an exception applies. A SIM swap alone does not establish that a patient information breach occurred.

If notification is required, covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting 500 or more individuals, the covered entity must also notify HHS without unreasonable delay and no later than 60 days; breaches affecting fewer than 500 individuals must be reported to HHS within 60 days after the end of the calendar year in which they were discovered. Additional media notice may be required when a breach affects more than 500 residents of a state or jurisdiction. Business associates must notify the covered entity as required by HIPAA and their agreement. See the HHS Breach Notification Rule guidance and HHS reporting instructions. Other laws or contractual duties may also apply, so confirm requirements with counsel.

In summary, secure the phone number and high-risk accounts, contain unauthorized access without compromising patient care, preserve imaging modality audit logs, and document a careful assessment of any exposure. Restore systems only through an approved process, and base any notifications on the investigation and applicable requirements.

FAQs.

What should be done first after a suspected SIM swap?

Contact the wireless carrier through a verified channel to recover the number and block further unauthorized changes. At the same time, alert your organization’s security or incident-response team, and secure high-risk accounts using a trusted device and a method other than SMS to the affected number.

How should imaging modality log server evidence be preserved?

Preserve relevant logs and related records before they are overwritten, keep originals protected from alteration, and document what was collected, when, by whom, and from which system. Coordinate collection with incident responders and system owners so evidence gathering does not unnecessarily disrupt clinical operations.

How can imaging services continue during system isolation?

Follow the organization’s approved downtime or emergency operations plan. Imaging leaders should determine which safe alternatives are available, communicate the authorized workflow, document examinations and decisions, and reconcile records after systems are restored. Do not bypass security controls or reconnect isolated equipment without incident-response approval.

When must a suspected patient information breach be reported?

A suspected incident must be assessed to determine whether unsecured PHI was impermissibly accessed, used, or disclosed and whether an exception or low-probability risk assessment applies. If it is a reportable breach, HIPAA generally requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery; reporting deadlines to HHS depend on the number of people affected. The privacy officer and legal counsel should confirm the applicable duties and timelines.