In 2020, one of the most devastating breaches in health tech history occurred. A psychotherapy company in Europe was hacked, and over 33,000 private therapy session notes were stolen. The attacker didn’t just leak the data; they attempted to extort individual patients. Some stories linked to this breach ended in tragedy, including multiple suicides.
It’s a heartbreaking example of how data insecurity isn’t just a technical issue. It’s deeply human.
The hardest part? It could have been prevented with a few basic security habits.
Whether you’re a founder, a CTO, or part of a fast-moving team, these three simple practices can dramatically reduce your risk of a breach and protect the people who count on you.
1. Prepare Your Email (Seriously)
Email systems are one of the most common entry points for attackers. Fortunately, they’re also one of the easiest places to strengthen your defenses.
Here’s where to start:
- SPF, DKIM , and DMARC:These DNS records validate your identity and prevent domain spoofing. Think of them as your email’s passport, visa, and ID card.
- Phishing and spam filters: Don’t rely on defaults. Tune these filters more aggressively than you’re used to. It’s better to quarantine too much than too little.
How Alternova supports you:
We help configure these protocols and protections so your email becomes a closed door, not an open invitation. From DNS setup to aggressive phishing filters, we make sure your first line of defense is rock solid.
2. Lock Down Your Credentials
Credentials are the keys to your kingdom. Attackers are always looking for copies.
Some of the most damaging breaches happen when secrets get casually shared — a password in a Slack message, a token in a shared doc, or a .env file in a repo.
Here’s how to lock things down:
- Use a secure password manager like Passbolt to handle internal credentials.
- For external sharing, use encrypted secret-sending tools. Never email passwords.
- Triple-check that your team isn’t saving secrets in plain text or hardcoding them into codebases.
How Alternova supports you:
It’s not just about tools. It’s about creating habits that scale with you.
3. Keep Everything Up to Date
Unpatched software is like a rusty lock. It might still function, but it’s far easier to break.
Every week, new vulnerabilities are discovered in operating systems, packages, and libraries. If your systems aren’t regularly updated, those vulnerabilities stack up quickly.
Here’s what you need:
- Automated tools that scan for outdated components.
- Pipelines that block insecure code from reaching production.
How Alternova supports you:
You’ll sleep better knowing that every build is automatically verified before it goes live.
Key terms, explained
The protections above rely on a handful of building blocks. Here's what each one does:
- SPF (Sender Policy Framework). If someone tries to send an email pretending to be from your domain using an unauthorized server, SPF tells the recipient's email server to reject or flag it.
- DKIM (DomainKeys Identified Mail). It ensures the integrity and authenticity of the message, preventing attackers from modifying email content during transit.
- DMARC (Domain-based Message Authentication, Reporting & Conformance). DMARC gives you full control and visibility over how your domain is being used in email, helping prevent phishing attacks and brand abuse.
- DNS records. They're the backbone for tools like SPF, DKIM, and DMARC. Configuring them properly helps stop attackers from impersonating your email domain, improving your security and email deliverability.
- .env files. These store sensitive settings like passwords, API keys, and tokens that your application needs to function — often loaded into the app at runtime.
- Secret vaults. They eliminate the need to hardcode secrets or send them insecurely. Vaults keep credentials locked away and accessible only when, and to whom, they're truly needed.
- CI/CD pipeline. It catches problems early and ensures consistent, secure updates to your application — no relying on manual checks or risky deployments; every update follows the same reliable path.
- Docker images. A Docker image is a packaged version of your application that includes everything it needs to run: code, system libraries, and tools. It lets your app work the same way no matter where it's deployed.
Final thoughts
Most breaches don’t happen because an attacker is brilliant. They happen because a team is growing fast, juggling priorities, and something slips. These three habits (securing your email, protecting credentials, and staying current with updates) can make all the difference.
And if you need a partner, we’re here.
At Alternova, we help health tech teams like yours build secure infrastructure, lock down sensitive data, and stay compliant. Your work can scale with confidence.
Let’s protect what matters. Together.
