The UnityPoint Health breach proves the planning might have been sophisticated, but the mechanism was as simple as a sent email.
