Spear-Phishing Incident Response Guide for Therapeutic Apheresis Units

A suspected spear-phishing email may be an isolated message, part of a wider campaign, or the start of account or endpoint compromise. Respond promptly, but tailor each action to the affected systems and the unit’s clinical needs. This guide supports—not replaces—your organization’s incident response, privacy, and clinical downtime procedures.

How should a suspected spear-phishing email be assessed and scoped?

Ask the recipient to stop interacting with the message: don’t click links, open attachments, reply, or forward it to colleagues. Have them report it through your approved security channel, and tell responders whether they clicked, opened, replied, entered credentials, approved a sign-in request, or downloaded a file. CISA advises staff to report suspected phishing to security teams rather than forward malicious messages to others.

Analyze the original message in a controlled environment. Email header analysis can help identify the message’s route and authentication results, while the sender’s display name, reply-to address, links, attachment names, message ID, and delivery time can help distinguish impersonation from legitimate correspondence. SPF, DKIM, or DMARC results are useful signals, not a stand-alone determination that a message is safe. See Microsoft’s phishing investigation guidance for header and message-trace analysis.

Record an initial timeline and scope: who received the message, when it arrived, whether it was opened or acted on, and which accounts or systems may be involved. Treat the report as a lead to investigate—not proof that an account or device was compromised. HIPAA’s Security Rule requires regulated entities to respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes; see HHS’s Summary of the HIPAA Security Rule.

How can responders identify affected recipients and endpoints?

Search mail-flow, gateway, and security-platform records for matching message IDs, sender addresses, subject lines, URLs, attachment hashes, and delivery windows. Check whether the message reached shared mailboxes, distribution lists, delegated mailboxes, or accounts used by the therapeutic apheresis unit. Extend the search to related messages with changed subjects, senders, or links; attackers may vary details across recipients.

For each recipient, determine whether they viewed the message, interacted with a link or attachment, entered credentials, or approved a multifactor-authentication prompt. Correlate those answers with sign-in logs, endpoint alerts, browser or proxy records, and mailbox audit activity. Identify the workstation or mobile device involved, its assigned user, and whether it has access to clinical applications, shared files, or apheresis-unit workflows. Investigate only within the organization’s approved authority and privacy procedures.

Use timestamps and other indicators to find related activity, not just the first reported mailbox. In Microsoft 365 environments, for example, audit searches can help identify sign-ins and mailbox forwarding or rule changes; the exact logs and retention available depend on the organization’s environment. See Microsoft’s audit-log investigation guidance.

How should malicious messages and indicators be contained?

Once responders have enough information to identify the message, use the organization’s mail-security tools to quarantine or remove matching copies, block confirmed malicious sender and URL indicators where appropriate, and prevent further delivery. Preserve a copy of the original message and its headers before making changes when feasible. Avoid broad blocks based on a display name or shared hosting address alone; an overbroad rule can disrupt legitimate clinical or operational communications.

If an account may be compromised, coordinate with identity and email administrators to block further unauthorized sign-ins, reset credentials through approved procedures, and consider session revocation. Review and remove unauthorized mailbox forwarding rules, inbox rules, delegated access, unfamiliar authentication methods, and suspicious application permissions. These actions should be based on the evidence and account risk; revoking sessions or disabling an account may also interrupt legitimate work. Microsoft documents these response steps for its services in its compromised email account guidance.

Containment should be recorded: what was blocked or removed, which users and systems were affected, when actions were taken, and who approved them. CISA recommends reporting phishing so responders can assess whether it is isolated and identify indicators to protect other users; see CISA’s phishing guidance.

How can teams investigate exposed accounts and compromised endpoints?

For possible credential exposure, establish whether the user submitted a password, reused a password, shared a one-time code, approved an authentication prompt, or entered credentials on a suspicious site. Reset exposed credentials using a trusted device and approved process; review recent sign-ins, authentication changes, new devices, application consents, and mailbox activity. A password reset alone may not end every active session, so assess whether session revocation and other account controls are also needed.

Review relevant audit records for unexpected sign-ins, mailbox access, sent messages, deletions, forwarding changes, new inbox rules, and access to files or applications. Look for activity outside the user’s normal pattern, but interpret location and device signals in context. Determine whether sensitive information may have been accessed or disclosed, and refer potential privacy incidents to the organization’s privacy officer or designated compliance team for assessment.

If a user opened an attachment or ran a file, examine endpoint alerts, process execution, downloads, persistence changes, and network connections. Malicious process analysis and other forensic work should be performed by qualified responders using approved tools. Consider endpoint isolation when there is evidence of active compromise or a credible risk of spread or data loss. NIST’s incident-response resources describe investigation and response practices, including handling different evidence sources; see NIST SP 800-61 Rev. 3 and NIST SP 800-86.

What evidence should be preserved and documented?

Preserve the original email, full headers, attachments or safely collected file samples, URLs, message IDs, relevant mail-flow records, sign-in and audit logs, endpoint alerts, and investigation notes. Capture timestamps with time zone and record the source system and collection method. Preserve evidence before deleting messages, removing rules, rebuilding systems, or making other changes whenever doing so will not create unacceptable risk to patient care or security.

Maintain an evidence log that identifies each item, who collected or handled it, when it was collected or transferred, and where it is stored. Record response decisions and actions—including account resets, session revocation, endpoint isolation, and clinical coordination—with their times, rationale, and approvers. NIST recommends procedures for evidence integrity, secure storage, and chain of custody; consult NIST SP 800-86 and your organization’s retention and legal-hold policies.

Document what is known, what remains uncertain, which systems and individuals may be affected, and what follow-up is required. A phishing email or exposed password does not by itself establish that a reportable breach occurred. For possible breaches of unsecured PHI, involve the privacy or compliance team to assess the facts under applicable requirements. HHS describes a risk assessment that considers the nature of the PHI, who received or used it, whether it was actually acquired or viewed, and mitigation; see HHS guidance on incident and breach assessment.

How should cybersecurity response be coordinated with clinical teams?

Notify the incident lead, unit manager, clinical engineering or biomedical staff, IT operations, privacy or compliance, and other roles named in the organization’s response plan. Share the operational impact in plain language: which account, workstation, application, or network service is affected; what containment is being considered; and what clinical workflow may be disrupted.

Before isolating or shutting down a system used in or near patient care, consult the responsible clinical and technical staff. Agree on a safe alternative workflow, communication channel, and escalation path if a scheduled treatment or other unit activity is affected. The exact plan depends on the equipment, configuration, and local procedures; do not assume that an apheresis device is connected to the network or that a cybersecurity action is safe for every device.

HIPAA’s Security Rule includes contingency planning for emergencies that affect systems containing ePHI and requires plans to support critical processes during emergency-mode operations. FDA guidance also recognizes that cybersecurity events can affect medical-device function and patient care. See HHS’s Security Rule summary and FDA’s postmarket medical-device cybersecurity guidance.

What response limitations matter in a therapeutic apheresis unit?

Patient safety and clinical continuity must inform containment decisions. A system that appears suspicious may also support time-sensitive clinical operations, while an abrupt shutdown or network change may create a separate operational risk. Do not delay necessary containment when a serious threat is evident, but coordinate the action with clinical leadership and the staff responsible for the affected equipment or workflow.

Responders may have incomplete logs, limited visibility into a vendor-managed system, or uncertainty about whether an endpoint is clinically essential. Do not install tools, run unapproved scans, change device configurations, or apply patches to medical equipment without the appropriate technical and clinical review. FDA guidance emphasizes assessing cybersecurity risk in relation to device safety and intended use; see FDA’s postmarket guidance.

Finally, distinguish confirmed facts from assumptions. An email report, a suspicious sign-in, or a detected file may warrant investigation without proving that PHI was accessed or that a device was compromised. Follow organizational policy for escalation, evidence retention, privacy review, and recovery. In short, assess the scope, contain verified threats, preserve evidence, and coordinate each action with the people responsible for patient care and affected systems.

FAQs

What should staff do after receiving a suspected spear-phishing email?

Stop interacting with it, do not forward it to colleagues, and report it through your organization’s approved security channel. Tell responders whether you clicked a link, opened an attachment, replied, entered credentials, or approved an authentication prompt. Follow the security team’s instructions and do not delete the message unless directed.

How can responders determine whether credentials were exposed?

Ask the recipient whether they entered a password, one-time code, or other authentication information, and determine which account and site or application were involved. Review sign-in records, authentication changes, and related account activity. If exposure is plausible, use an approved process to reset the credentials and assess whether session revocation or additional account controls are needed.

When should an affected endpoint be isolated?

Consider isolation when evidence indicates active compromise or a credible risk of malware execution, lateral movement, or data loss. First assess whether the endpoint supports patient care or other time-sensitive unit operations, and coordinate with clinical leadership and the responsible technical staff. Use the organization’s approved isolation procedure and document the decision.

How can incident response actions avoid disrupting patient care?

Coordinate proposed changes with the unit manager, responsible clinicians, IT, and clinical engineering or biomedical staff. Identify affected workflows, agree on safe alternatives, and use established clinical downtime procedures where needed. Avoid unapproved changes to medical equipment, and document the clinical and security rationale for actions taken.

Effective response combines timely reporting, evidence-based containment, careful documentation, and coordination with clinical teams. Apply those principles within your organization’s approved incident, privacy, and clinical continuity procedures.