A successful business email compromise (BEC) campaign targeted a senior medical practitioner's Microsoft 365 profile at the Royal Women's Hospital in Melbourne. The threat actors monitored the inbox, gaining exposure to detailed care logs and identity data for 200 patients.