According to Weill Cornell Medicine's Notice of Email Phishing Incident, attackers gained unauthorized access to a small number of employee email accounts between September 9 and September 23, 2021 as part of phishing attempts. Closing a phishable workforce email login stops that credential-phase path. Residual patient details already sitting in an opened mailbox are post-authentication exposure that no login MFA retracts.

For the full disclosure timeline and what-happened facts, read the companion on legacymfa.sucks.

FAQ

Would phishing-proof MFA have stopped Weill Cornell mailbox access?

Phishing-proof device-bound MFA would have blocked the Weill Cornell Medicine credential-phase path wherever those employee mailboxes still accepted transferable secrets a phishing attempt could steal or coach. Public reporting does not establish the exact phishing page, factor type, or pre-incident MFA coverage on the accounts accessed between September 9 and September 23, 2021. What the notice does establish is unauthorized access driven by phishing attempts. When login demands a private key that never leaves the enrolled device and never travels as a typed code or push approval, a remote phishing attempt has nothing useful to capture. That is prevention, not detection.

Why can't MFA undo PHI already in a compromised Weill Cornell mailbox?

MFA cannot undo residual PHI in a Weill Cornell employee mailbox once authentication has already succeeded for that account. According to Weill Cornell Medicine, possible exposure included patient names, contact and insurance details, medical record numbers, clinical information, and Social Security numbers in limited instances. Electronic medical records were not accessible. The organization believed the goal was further phishing, not deliberate patient-data targeting, and reported no indication patient information was misused. Login controls stop the next phishable sign-in. They do not scrub mail already readable in an attacker-held session.

Is expanding multi-factor authentication enough after healthcare email phishing?

Expanding multi-factor authentication after the Weill Cornell Medicine email phishing incident is necessary but incomplete if the new factors remain phishable. Weill Cornell stated it was requiring all devices to use multi-factor authentication and adding employee training on suspicious email. OTP, SMS, email codes, and push approvals still travel or approve in ways a live phishing attempt can abuse. Phishing-proof MFA 2.0 removes transferable factors across the identity lifecycle so registration and authentication both refuse coached secrets. Training still matters for lure recognition. It is not a substitute for closing the login path.

How do passkeys compare to phishing-proof MFA for workforce email?

Passkeys are phishing-resistant at the login ceremony because signatures are origin-bound. They do not automatically make enrollment and recovery phishing-proof if those stages still use email OTP, SMS, or helpdesk-issued secrets. For workforce email after an incident like Weill Cornell Medicine's, hardening only the password prompt leaves lifecycle gaps. MFA 2.0 is phishing-proof across registration, device onboarding, authorization, authentication, and decommissioning. The device-bound architecture keeps private keys on hardware the attacker never holds.

What should CISOs change for employee mailbox login after Weill Cornell?

CISOs facing Weill Cornell-style workforce email phishing should treat employee mailbox sign-in as a high-value identity surface and retire transferable factors there. Prefer phishing-proof, device-bound credentials so a phishing attempt cannot finish login with a stolen password or coached code. Pair that with session revoke playbooks for accounts that already authenticated, because residual mail content is post-auth work. Weill Cornell's notice also stressed training. Training reduces click rates. It does not fix a login that still accepts phishable secrets.