The Night the Badge Didn't Work

The story

The call came on a Tuesday at 11:40 p.m. Amara Okafor, who ran the Lakeside clinic, had tried to log into the records system from home and been told her password was wrong. It wasn’t wrong. She’d typed it twice, slowly, the second time with the caps-lock ceremony of someone who has been using computers long enough to distrust them.

Ana, who had built the records system and everything around it, opened the database from her kitchen table. Amara’s password hash had been changed at 10:52 p.m. So had the account’s recovery email. Whoever did it had logged in with Amara’s real password — no exploit, no injection, just the front door.

The next four hours reconstructed themselves into the kind of timeline you never forget writing. A botnet had been quietly working Meridian’s login page for eleven days — a few attempts per minute, thousands of email addresses from someone else’s breach. The login page had no rate limit, because the login page was two hundred lines Ana had written in 2019 between actual features. It answered Unknown user for strangers and Wrong password for real accounts, so by day three the attackers had a verified list of Meridian staff. Amara’s password — reused from a retail site that had been breached years earlier — matched on day eleven.

There was no MFA. There was no alert. And when Meridian’s leadership asked the only question that mattered — which patient charts did they open? — the answer was a shrug wearing a spreadsheet. The application logged errors, not access. Legal had to assume everything Amara could read had been read, and notify accordingly.

The disclosure letter went to 4,300 patients. The word “incident” appeared eleven times.

Why this is hard the traditional way

Nothing in that timeline is exotic. Credential stuffing is the weather — billions of leaked email/password pairs, replayed patiently against every login page on the internet. The defenses are all known: rate limits shaped for distributed attacks, uniform errors that don’t confirm accounts, response timing that doesn’t leak, lockouts that don’t create their own denial of service, MFA, and an audit trail that can say what happened afterward.

The problem is that “known” is not “built”. Each defense is a week of careful work with sharp edges — get the error messages uniform but forget the timing oracle, add a per-IP limit that a botnet load-balances around, log enough to debug but not enough to reconstruct. A product team building clinic software will never prioritize eleven security features that only matter on the worst day. So the login page stays two hundred lines, and the worst day arrives with a list of verified emails.

How Sentinel changes the ending

Replay the eleven days against a Sentinel login and the attack dies on day one, four separate ways. The stuffing heuristic notices hundreds of distinct identifiers failing from each exit node — the one shape a legitimate NAT never produces — while per-IP, per-account and lockout windows layer under it, each aimed at a different evasion pattern. Unknown user and wrong password return the same invalid_credentials, in the same number of milliseconds, because the unknown-user path burns a dummy argon2id hash on purpose: no verified list, no day-three target file.

Amara’s account would have demanded a second factor the moment a new device appeared — the risk engine scores new device, impossible travel and velocity deterministically, and steps up at the threshold. And the question that ended the night in a shrug — what did they touch? — has an answer, because every login, failure, lockout and admin mutation lands in an event stream and a tamper-evident ledger built precisely for the morning after.

None of that is a feature Ana would have had to schedule. It is the default behavior of the front door.

What it costs you to ignore this

• Breach notification is priced per patient. 4,300 letters, credit monitoring, regulator correspondence — the invoice for a missing rate limit has a lot of line items.
• “Assume everything was accessed” is the most expensive sentence in security. Without an access trail you must disclose the maximum, not the actual.
• Verified account lists outlive the incident. The enumeration leak armed every future phishing campaign against Meridian’s staff, forever.
• Trust erodes asymmetrically. A clinic asks patients to hand over their history; one reused retail password ended up testing that promise for all of them.