Veterinary Clinic Cybersecurity: A Real Remote Access Scam

How a New Patient Inquiry Exposed a Veterinary Clinic Cybersecurity Threat

Veterinary clinic cybersecurity isn’t just about protecting medical records from hackers. Sometimes it begins with something as ordinary as scheduling an appointment for a Labrador Retriever.

On October 20, 2026, a Massachusetts veterinary practice became the target of a carefully constructed email scam. What started as a believable new-patient inquiry turned into an unauthorized remote-access incident involving two computers.

The attacker used the branding of a legitimate Westin hotel, a fake Google Drive document-sharing notification, and a supposed veterinary medical record to convince clinic staff to install remote-access software.

Here’s what happened, how our security monitoring helped us identify the intrusion, and what other veterinary practices can learn from it.

Watch: How a Routine Customer Email Became a Cybersecurity Incident

In this four-minute video, I explain how the phishing attack unfolded, how our monitoring detected the unauthorized remote access, and what other small businesses can learn from the incident.

It Started With a Routine Appointment Request

On Monday, October 19, a Massachusetts veterinary clinic received an email from someone asking about an examination and possible treatment for a Labrador Retriever.

The message was polite, professional, and entirely plausible. The sender asked about consultation fees, available services, and appointment times.

A clinic employee responded just two minutes later, explaining that new clients should complete the registration form on the clinic’s website and that the initial examination fee was $106.

Nothing about that exchange required an unusual response. Veterinary hospitals receive inquiries like this every day.

The sender’s signature was particularly convincing. It identified the individual as a senior manager at The Westin Jekyll Island and included hotel branding, promotional imagery, and references to Marriott Bonvoy.

The Westin Jekyll Island is a real hotel. The attacker was impersonating an association with that legitimate business.

This technique is called brand spoofing. Criminals use the names, logos, and visual identities of recognized organizations to make fraudulent communications appear trustworthy.

The Westin Jekyll Island and Marriott had no known involvement in the attack. Their legitimate branding was misused in an impersonation scheme, making them victims of the deception as well.

The Medical Record Wasn’t a Medical Record

The following afternoon, October 20, the sender replied to the clinic.

The email acknowledged the $106 examination fee, explained that the owner would be paying without pet insurance, and promised to complete the new-patient registration form.

It also said that the Labrador Retriever’s veterinary records had been shared for review.

That last detail changed everything.

Embedded in the message was what appeared to be a Google Drive sharing notification. It displayed a PDF icon, a veterinary medical-record filename, and a prominent blue Open button.

To a busy receptionist preparing for a new patient, reviewing the animal’s medical history would seem like a perfectly reasonable next step.

Our examination of the original email revealed that the apparent PDF link did not lead to a medical record.

Instead, it pointed to an executable installer named ScreenConnect.ClientSetup.exe.

Even the notification’s Block sender link directed to the same installer.

That is an important distinction. The attacker wasn’t simply trying to trick someone into viewing a suspicious document. The objective was to get remote-access software installed on a clinic computer.

The email also included a familiar social-engineering detail: the sender said they were heading into a board meeting and would be available to talk later. That made the interaction feel like a normal business conversation while discouraging immediate telephone verification.

Why the Hotel Branding Mattered

The attacker didn’t rely on a generic email signature.

The message used the identity of a real hospitality business, complete with Westin branding and a polished promotional banner.

The sender’s domain also resembled the hotel’s website, but contained a subtle spelling difference.

When we attempted to visit the suspicious domain, the browser reported that the connection had timed out.

A website timeout alone doesn’t prove that an email is fraudulent. Legitimate websites can be temporarily unavailable.

The more important warning signs were the lookalike sender domain and the supposed medical-record link that actually delivered remote-access software.

When an unexpected email or phone call asks you to take action, independent verification is essential. As we explain in Hang Up. Call Back, contacting an organization through a trusted number or website can help expose an impersonation attempt.

The lesson is simple: a recognizable company logo and a professional email signature do not verify who sent a message.

What Happened After the Software Was Installed?

ScreenConnect, now commonly associated with ConnectWise ScreenConnect, is legitimate remote-support software. IT providers use tools like it to assist customers with technical problems.

But when someone installs remote-access software at the direction of an unknown sender, that software can give an unauthorized person access to the computer.

In this incident, the investigation established that ScreenConnect components had been installed on two clinic workstations.

We also confirmed three unauthorized interactive remote-access sessions across those computers.

Security telemetry recorded additional suspicious activity involving PowerShell and an external network destination.

That meant this was no longer merely a suspicious email. Someone had obtained remote access to systems used by the veterinary practice.

What we have not established is whether the intruder copied patient records, stole credentials, or removed other information. Remote access creates those possibilities, but the presence of the software and the session logs alone do not prove data theft.

That distinction matters when assessing a cybersecurity incident and deciding what additional investigation is required.

How Proactive Security Monitoring Helped

Fortunately, the veterinary clinic had security monitoring in place.

Slingshot’s Datto remote monitoring system generated alerts associated with the unexpected ScreenConnect installation and activity.

Those alerts gave us a reason to investigate promptly, rather than waiting for someone to notice unusual behavior or report a malfunctioning computer.

This is why we emphasize proactive monitoring rather than waiting for employees to report problems. Our article, How Proactive Cybersecurity Monitoring Stopped a Remote Access Scam, explains how early detection can help limit an attacker’s opportunity to cause damage.

Our investigation connected the suspicious activity to the remote-access software and established that two computers had been affected.

We contacted the clinic, used our authorized management tools to investigate, and manually stopped and disabled the unauthorized ScreenConnect services.

We subsequently isolated both affected computers using endpoint security controls.

The next phase of the response called for preserving the original drives as evidence and installing replacement drives with clean Windows 11 installations.

Preserving the original drives is important because they may contain evidence needed to determine what happened during the unauthorized sessions.

A clean operating system installation on a new drive also avoids relying on a potentially compromised Windows installation.

This is an example of why veterinary clinic cybersecurity requires more than antivirus software. Security monitoring, investigation, containment, and a practical recovery plan all have different roles.

Five Lessons Every Veterinary Practice Can Apply

1. Verify Unexpected Requests to Open Medical Records

Receiving veterinary records from a new client is normal. Being directed to install software to view those records is not.

If a link downloads a program instead of opening the expected document, stop and contact your IT provider.

2. Don’t Trust Branding Alone

The attacker’s email included recognizable hotel branding and a professional signature.

That appearance was part of the impersonation.

Check the actual sender’s address and independently verify unexpected requests, especially when they involve software downloads or remote access.

3. Treat Remote-Access Software as a Security-Sensitive Tool

ScreenConnect, AnyDesk, TeamViewer, and similar products have legitimate business uses.

They can also be abused.

Employees should never install remote-access software at the request of an unknown caller, email sender, or supposed customer without approval from their IT provider.

4. Make Reporting Easy

A receptionist who encounters an unexpected download should know exactly whom to call.

Employees shouldn’t need to decide whether an email is technically malicious before asking for help.

A simple rule works well: If a document asks you to install something, stop and call IT.

5. Monitor Computers for Unauthorized Activity

Even good employee training cannot prevent every mistake.

That’s why we recommend layered protection that includes endpoint monitoring, security alerts, controlled administrative privileges, tested backups, and a documented incident-response process.

These protections work best together. In The Anatomy of a Cyber-Ready Business, we explain how multiple layers of security help businesses reduce risk. Our article, Cybersecurity Breach Response: Lessons From the Other Side, explores what happens when an attack succeeds and why having a response plan matters.

What Should You Do If Someone Has Already Installed Remote-Access Software?

If an employee has installed an unexpected remote-access program, don’t assume that closing the window or uninstalling the application resolves the problem.

Contact your IT provider or security response team immediately.

Depending on the circumstances, the response may include isolating the affected computer, preserving logs and evidence, identifying active remote sessions, investigating other systems, reviewing account access, and rebuilding the computer from trusted installation media.

Avoid casually deleting evidence or restoring a computer to service before the extent of the incident has been assessed.

The Cybersecurity and Infrastructure Security Agency (CISA) also provides practical guidance for recognizing and reporting phishing attempts.

Frequently Asked Questions

Can a fake veterinary medical record install remote-access software?

Yes. A message can display a PDF icon or document filename while linking to an executable program instead. The file type and actual download destination matter more than how the link appears in the email.

Is ScreenConnect malware?

No. ScreenConnect is legitimate remote-support software. The security problem arises when someone installs or uses it without authorization, particularly when an attacker deceives an employee into granting access.

Can someone using remote-access software copy files from a veterinary clinic?

Potentially, yes. Remote-support tools may offer file-transfer capabilities and other access to the computer. Whether files were actually copied must be determined from evidence, not assumed merely because a remote session occurred.

Does antivirus protection prevent this type of attack?

Not necessarily. Legitimate, digitally signed remote-access software may not be classified as malware. Monitoring for unauthorized installation and suspicious behavior provides an additional layer of protection.

What is the most important cybersecurity precaution for a veterinary receptionist?

Never install software to open an unexpected attachment or shared document without approval. If a supposed client asks you to install something, contact your IT provider before proceeding.

Veterinary Clinic Cybersecurity Is About Prevention and Response

The most striking part of this incident is how ordinary it looked at the beginning.

A new patient. A Labrador Retriever. A question about examination fees. A professional email signature. A medical record to review.

Every element was chosen to fit the clinic’s normal workflow.

The attack demonstrates why veterinary clinic cybersecurity must account for how people actually work, not just the technical threats that security software can detect.

At Slingshot Information Systems, we help small businesses and veterinary practices throughout Northeastern Massachusetts maintain reliable technology, protect their information, and respond when something goes wrong.

Could This Happen to Your Business?

A convincing email, an unexpected software installation, and a few minutes of unauthorized access can put your business at risk.

Not sure whether your computers are adequately protected against remote-access scams? Let’s talk about your current security, monitoring, and response procedures.

Schedule a Conversation With Stan

No scare tactics. Just a practical conversation about protecting your business.

This article describes an actual security incident involving a Slingshot client. The veterinary practice and its employees have been anonymized. The hotel’s branding was used in an impersonation attempt, and there is no evidence that the legitimate hotel or its employees were involved.