For many, it’s a morning ritual. Come to work, grab a cup of coffee and start answering those emails. The sooner you’re caught up, the sooner you can get started on the day. Because of this, you may skim internal emails a little more quickly, only acting on what’s asked of you. After all, these work-related messages are from people you trust— right?
You might want to start reading those emails a little more closely because you could be at risk of falling for a phishing scam — commonly conducted through fraudulent email messages that may seem trustworthy but are really just tools for cybercriminals to infect your network with malware.
In fact, with just a few clicks and some well-masked imitation emails, scammers were able to gain access to a major health network’s wealth of patient information earlier this year.
Let’s take a look at just how shockingly easy this was to pull off and what your organization can do to safeguard against suffering a similar breach.
Employee Errors
UnityPoint, a Midwestern-based health network, recently had the unenviable job of notifying 1.4 million of their patients that their data could be at risk in what is one of the largest healthcare data breaches of 2018 so far.
On May 31st, UnityPoint noticed that their network had been compromised sometime between March 14th and April 3rd, 2018. The attack on their system was carried out through the use of phishing emails.
These messages attempt to manipulate emotions by sending an email disguised as a member of your own organization, or an intimidating notice about overdue bills and terrifying consequences. They sometimes look so real that employees might mistake them for just another mandatory email, which is exactly what happened to UnityPoint.
Essentially, employees received emails asking for personal information (including personal log-in credentials) which allowed attackers to have open access to patient information.
While authorities believe the intention behind this attack was not to steal private patient data but instead to divert large payments and steal business funds, everything from a patient’s medical history to their social security number was still exposed.
Furthermore, this data breach sticks to an unsettling cyberattack trend — the time between when the attacks occurred and when they’re recognized is excessive. The longer you stay unaware of a potential attack, the more you’re at risk.
The Solution
Cyber attackers continue to adapt in order to find new ways to threaten your system. You need a next-gen assessment which can help determine whether or not your organization is at risk of a breach similar to what UnityPoint suffered.
With our Red Team Assessment, we offer a comprehensive evaluation against anything a skilled, human attacker might try, such as:
- Penetration Testing (internal and external)
- Social Engineering/Phishing Attacks (by phone, email and in-person, we take this to the next level by attempting an actual breach of your network)
- Physical Access (perimeter sweep, building access, secure interior room access)
- Black Box (planting rogue remote-access devices in the production network)
- Secure Document Disposal (secure/common waste disposal, dumpster inspection)
- Wireless (forged authentication, encryption testing device spoofing)
Contact us today if you’re ready to get serious about keeping your systems secure.
