Just because a medical agency is "obviously" on the cybercriminal radar doesn't mean that the rest of us are "obviously" off it.