Phishing-proof MFA stops Henry Ford email path

Closing the phishable workforce email login is what blocks a Henry Ford Health-style path. According to Henry Ford Health's substitute notice, an email phishing scheme on 30 March 2023 gave an unauthorized party access to three employee business email accounts; on 16 May 2023 the organization determined protected health information may have been present in those mailboxes, and later notices cited roughly 168,215 patients potentially exposed. Phishing-proof device-bound MFA removes transferable secrets at sign-in so that mailbox takeover never starts. PHI already sitting in mail the attacker can read is residual post-auth exposure no login control undoes.

For the full attack-chain write-up, read the companion on legacymfa.sucks.

FAQ

Would phishing-proof MFA have stopped the Henry Ford Health mailbox access?

Phishing-proof MFA 2.0 would have blocked the credential-phase path that opened the three Henry Ford Health employee business email accounts, with one honesty limit. Public reporting does not establish the lure text, what secret was captured, or whether any MFA was present. What the substitute notice does establish is an email phishing scheme that produced unauthorized mailbox access. Device-bound, origin-bound signatures leave no password, OTP, SMS code, or push approval for a phishing message or page to harvest, so the attacker never completes workforce email sign-in. Closing that phishable login stops this path. Malware after a legitimate login is a harder, separate problem.

Why doesn't login MFA undo the ~168,215-patient PHI risk?

Login MFA does not undo the Henry Ford Health PHI risk once the three employee business email accounts were already open. The organization assessed exposure from content that may have been present inside those mailboxes after unauthorized access, not from a separately documented EHR break-in in the public notice. Files and messages readable in a live session are post-authentication residual data access. Prevention value sits upstream: the phishing scheme never obtains a usable employee email sign-in. Revoke, mailbox review, and patient notice remain hygiene after the fact.

Are passkeys enough for healthcare employee email, or do you need MFA 2.0?

Passkeys are phishing-resistant at the login ceremony; MFA 2.0 is phishing-proof across the identity lifecycle. For a Henry Ford Health-style workforce email phishing path, origin-bound passkey login already removes the reusable password and typed OTP surface most email phishing needs. The extra MFA 2.0 claim matters when enrollment, device onboarding, or recovery still accept phishable factors, because an attacker who controls those factors can register their own device that later looks legitimate. Public reporting does not show a recovery or enrollment failure here. The honest prevention story for this breach is still removing phishable secrets from employee email authentication, which prevention-focused device-bound design does without relying on detection after the mailbox is open.

What should healthcare identity teams change after a three-mailbox PHI notice?

Healthcare identity teams should treat ordinary employee business email as a high-blast clinical channel, not a low-stakes inbox. Henry Ford Health shows three compromised workforce mailboxes can still drive six-figure patient-notice scope when PHI rides in day-to-day mail. Prioritize phishing-proof sign-in on mailbox and IdP paths so email phishing cannot mint an employee session. Keep post-auth controls for residual cases: rapid session kill, mailbox content review, and clear PHI-handling rules in mail. Do not confuse those containment steps with prevention at login.

Does shortening email session lifetime fix this attack class?

Shortening email or cloud session lifetime does not prevent Henry Ford Health-style employee email phishing. Lifetime limits only force an attacker who already holds a session to re-steal or re-authenticate sooner. If the root failure is a phishable workforce login, the fix is removing transferable factors so the phishing scheme never completes sign-in. Session revoke and shorter tokens stay useful hygiene after malware or another post-auth foothold on an already-logged-in PC, not as a substitute for phishing-proof authentication.