How weak passwords and other failings led to catastrophic breach of Ascension

The Ars Technica piece recounts how Ascension’s ransomware breach exposed 5.6 million patients’ records and disrupted care across 140 hospitals, highlighting security failings alongside Microsoft’s ongoing use of Kerberos with a weaker fallback. It notes the hack began in February 2024 with the compromise of a contractor’s laptop after they downloaded malware via a Bing search result, with attackers moving from that device to Ascension’s Windows Active Directory and using Kerberoasting to pivot within the network.

A key focus is a weak password, with researchers arguing that even 14-character passwords can be crackable when paired with legacy authentication and insufficient security controls; Ascension has not publicly explained its compromised password, though officials have pointed to a lack of network segmentation, least-privilege, and other standard measures. The timeline shows the breach being noticed on 8 May, after the February infection, leaving some months of offline activity, and Sen.

Ron Wyden has pressed for answers and an FTC investigation into Microsoft’s role, according to Sen. Ron Wyden. The story also discusses Microsoft’s historical RC4/NTLM security and how modern guidance now urges stronger defaults and protection measures, with experts suggesting improvements such as Managed Service Accounts and tighter access controls to mitigate Kerberoasting risk.