Mom, why did grandfather let others take over his online bank account and send his inheritance money overseas?
He just didn't care, honey. He was a good man, but he simply did not care.
Evidently someone at the hospital had to have been involved, although we never learned the vector.
It’s really not a stretch to imagine a sophisticated attacker who specializes in identity theft paying off hospital staff for access to dead patient’s info, even phones. It’s the last thing on the families minds.
We already know that insiders at cell providers are working with SIM swappers to compromise SMS verification. Why is it unlikely for hospital staff to do the same?