PET CT Report Email Spoofing Incident: Oncology Results Sent to the Wrong Outside Clinics — What Happened and How to Prevent It

Incident Overview

What happened

An attacker impersonated your radiology domain and sent emails that appeared to contain PET CT report results to multiple outside clinics. The messages looked routine and used familiar subject lines and signatures, leading recipients to trust the content.

The spoofed emails were not sent from your mail servers. Instead, the adversary forged the visible sender to mimic your organization, exploiting gaps in domain authentication and recipient verification workflows.

Scope and detection

Alerts surfaced when external recipients questioned unusual formatting and when DMARC aggregate data showed unauthorized traffic using your domain. Message headers revealed delivery paths inconsistent with your infrastructure.

Because the payload referenced oncology findings, the event posed a credible risk to Health Information Privacy and prompted an immediate PHI Breach assessment and containment steps.

Key takeaways

• This was Email Spoofing rather than confirmed mailbox compromise.
• Lack of enforced DMARC Implementation, DKIM Authentication, or restrictive SPF Records enabled deception.
• Clinical workflows that accept emailed results increased the chance of misdirection and data exposure.

Nature of Email Spoofing

How spoofing works

Email Spoofing manipulates visible sender fields so a message appears to come from a trusted domain. Without strong domain authentication, receiving systems cannot reliably verify that “From” equals the true sending source.

Common techniques include exact-domain spoofing, display-name abuse, and look‑alike domains that differ by a character. Each aims to bypass human and technical trust checks.

Why controls failed

When SPF Records are missing or permissive, a hostile server can claim your domain. If DKIM Authentication is absent or misaligned, cryptographic validation fails. Without DMARC Implementation in enforcement mode, receivers often deliver or only flag these messages.

Clinics accustomed to receiving PET CT results by email may not verify authentication results, allowing forged messages to land in clinical workflows.

Why PET CT reports were targeted

Attackers study predictable subject lines and attachments to increase credibility. Phrases like “final oncology results” and familiar report layouts make forged messages blend into daily operations.

Busy clinic staff may act on these messages quickly, forwarding or filing them, which can propagate exposure before any warning is raised.

Impact on Patient Privacy

Risks to individuals

Exposed PET CT data can include names, dates of birth, medical record numbers, and sensitive oncology findings. Such disclosures undermine Health Information Privacy and may cause embarrassment, discrimination risks, or identity misuse.

Clinical harm is also possible if outside clinics rely on forged or altered results, leading to delayed or inappropriate care decisions.

Regulatory and organizational impact

Unauthorized disclosure of medical information can constitute a PHI Breach, triggering notification obligations and potential penalties under applicable laws and contracts. It also erodes trust with patients and referral partners.

Remediation consumes incident response resources, disrupts clinical operations, and may require long-term security investments and oversight.

Causes of Spoofing Vulnerability

Authentication gaps

• SPF Records absent, overly broad, or not updated to reflect all legitimate senders.
• DKIM Authentication not enabled for every mailing system, using weak keys, or failing alignment with visible From domains.
• DMARC Implementation left at monitoring (p=none) instead of quarantine or reject, and no subdomain policy.
• Inconsistent envelope/header From values that break alignment and confuse receivers.

Process and workflow issues

• Reliance on emailed results rather than secure portals, increasing exposure if messages are spoofed or misrouted.
• Open distribution lists and outdated address books that accept messages without authentication checks.
• Staff and partners unfamiliar with checking authentication indicators before processing attachments.

Technology and integration factors

• Third-party services sending on your behalf without proper SPF/DKIM configuration and alignment.
• Lack of transport enforcement for Secure Email Transmission, enabling interception or tampering risks alongside spoofing.
• Insufficient monitoring of DMARC reports, leaving domain abuse undetected.

Prevention Measures

Authenticate your domain comprehensively

• Publish precise SPF Records that enumerate permitted senders and end with a hard fail (-all).
• Enable DKIM Authentication with 2048‑bit keys for every platform that sends mail, rotate keys, and ensure alignment with the visible From domain.
• Roll out DMARC Implementation in stages: monitor (p=none), then quarantine, then reject once legitimate sources align. Define subdomain policy and review aggregate/forensic reports.

Secure the channel and the content

• Enforce Secure Email Transmission with mandatory TLS to trusted partners and adopt MTA‑STS where feasible.
• Digitally sign outbound clinical emails (S/MIME or equivalent) so recipients can verify authenticity; encrypt when possible.
• Prefer patient and partner portals for results delivery; send authenticated links rather than attachments containing PHI.

Minimize PHI in email

• Apply the minimum necessary principle and avoid embedding full PET CT reports in email bodies or attachments.
• Use data loss prevention to detect PHI patterns and block risky transmissions.
• Expire shared links and require strong recipient authentication before access.

Strengthen people and processes

• Train staff and external clinics to check authentication indicators and treat unexpected result emails with caution.
• Validate partner addresses periodically; retire unused distribution lists and enforce approval for new recipients.
• Continuously monitor DMARC data to spot spoofing spikes and new abuse sources.

Prepare to respond

• Maintain an incident playbook covering containment, evidence collection, legal/privacy review, and communications.
• Keep up-to-date contacts for major clinic partners to issue rapid advisories if spoofing occurs.

Response and Remediation Actions

Stabilize and contain

• Alert partners to disregard recent result emails and verify through a secondary channel.
• Temporarily tighten policy by moving DMARC toward quarantine/reject if alignment is ready.
• Block look‑alike domains and request takedowns where applicable.

Investigate and assess

• Collect full message headers and samples; confirm external origination and authentication failures.
• Review DMARC, SPF, and DKIM configurations across all senders; identify misaligned systems.
• Conduct a PHI Breach risk assessment to determine exposure scope and next steps.

Remediate and harden

• Fix alignment across every legitimate sender and publish updated SPF Records and DKIM keys.
• Move DMARC to enforcement with policy monitoring to reduce false positives.
• Shift result delivery to authenticated portals and require Secure Email Transmission for any remaining email workflows.

Communicate and document

• Notify internal stakeholders, affected clinics, and patients as appropriate, providing concrete verification steps.
• Record root causes, decisions, and improvements to inform future training and audits.

Importance of Secure Communication

Why email alone is not enough

Traditional email was not designed to prove sender identity or protect sensitive content. Even with authentication, forwarding and misaddressing can still leak PHI if reports travel as attachments.

Replacing attachments with authenticated portal access materially reduces the blast radius of mistakes and attacks, while preserving usability for clinical partners.

Safer defaults for clinical results

• Use portals or standards‑based secure messaging for report delivery, with recipient authentication and access logging.
• Adopt message signing so clinics can verify authenticity before filing results.
• Automate reconciliation: results are accepted only if sender identity and patient/context metadata pass validation.

Summary

This PET CT Report Email Spoofing Incident shows how weak domain controls and email‑centric workflows enable sensitive misdirection. By enforcing SPF, DKIM, and DMARC, requiring Secure Email Transmission, minimizing PHI in messages, and favoring portal delivery, you sharply reduce spoofing risk and protect patient privacy.

FAQs.

What is email spoofing in healthcare?

Email spoofing is when an attacker forges the visible sender so a message appears to come from a trusted healthcare domain. In clinical settings, this can mimic routine workflows like sending imaging results, tricking recipients into trusting falsified messages.

How can spoofing result in sensitive data exposure?

If staff process forged emails, they may forward PHI, save attachments to shared systems, or act on false results. Even when attackers do not have real data, their messages can prompt replies containing PET CT reports or other PHI, creating an inadvertent disclosure.

What measures prevent email spoofing?

Implement restrictive SPF Records, enable DKIM Authentication for all senders, and move DMARC Implementation to enforcement. Pair these with Secure Email Transmission, digital signatures, portal-based delivery of reports, DLP scanning, and user training to verify authentication before filing results.

How should affected parties be notified?

Coordinate with your privacy, compliance, and legal teams to provide timely, plain‑language notices to patients and partner clinics. Explain what happened, what information may be involved, how you are protecting them, recommended next steps, and how to reach your organization for support, consistent with applicable regulations and policies.