A new cybersecurity report from San Francisco-based Abnormal Security found that medical industries and insurance companies had a 45-60% chance of being the target of a phone fraud attack via email: a sophisticated scam where the scammer sends an email to the target, asking the target to call them. In the second half of 2021, those attacks increased by 10 percent.
Additionally, healthcare systems are seeing a rise in more legitimate-looking yet problematic business email compromise (BEC) attacks. This occurs when the scammer accesses the target’s business email and impersonates the target, and then uses that identity to create rapport with victims and get them to pay money.
“In the second half of 2021, email attacks increased by 10 percent. Healthcare systems are also seeing a rise in more legitimate-looking yet problematic business compromise emails, which can cost victims as much as $2.4 billion,” said Crane Hassold, former FBI analyst and director of threat intelligence at Abnormal Security in an email forwarded from a representative. “Our report saw medical industries had a 68.9% chance of receiving a business email compromise attack each week.”
The report quantified how many different kind of attacks occur, and the numbers are not only big, but growing. For example, the chance of a large business experiencing a phone fraud attack: 72%. And that’s their weekly risk.
Supply chain attacks, an emerging threat type, were also up: there was a 67% chance of experiencing such an attack in the second half of 2021, according to the report. In such instances, the attackers phish in hopes of penetrating the target’s email. The attacker then leverages the target’s email and contact base to send phony invoices to clients, which can be particularly difficult to detect, the report said.
Additionally, voice phishing – vishing – has increased, the report noted. Such attacks typically begin with an email requiring the user to call, or else face some threat, such as a pending charge. For example, the report found scammers imitated companies ranging from Amazon to PayPal to Microsoft to Best Buy. The rate of such scams increased over 2021, according to the report.
A Deep-dive Into Specialty Pharma
A specialty drug is a class of prescription medications used to treat complex, chronic or rare medical conditions. Although this classification was originally intended to define the treatment of rare, also termed “orphan” diseases, affecting fewer than 200,000 people in the US, more recently, specialty drugs have emerged as the cornerstone of treatment for chronic and complex diseases such as cancer, autoimmune conditions, diabetes, hepatitis C, and HIV/AIDS.
And the risks went all the way to the C-suite. The report found a 23.9% increase in executive targeting from June through December of 2021.
“A major takeaway from Abnormal Security’s H2 Threat Report is that cyber criminals are turning from low-value attacks to more sophisticated, high-value strategies that use social engineering to trick recipients into sending money or leaking sensitive information. These threats don’t appear malicious making it easy for them to slip past secure email gateways and land in employee inboxes where they can cause significant damage,” Hassold said in an email provided by a representative.
Historically attacks included a link in the email the scammers would hope the target would click on after opening the email. Software protecting against cyber attacks often looks for as much. However, this year the report found that scammers moved away from such links, turning to more sophisticated tactics. Instead the emails often do not have a link, but instead prompt the target to call a number, thus evading some tradition protection measures. In some cases there is no email and the scammer calls the target directly.
“Cyber attacks are easily the #1 threat to organizations today–ransomware attacks, business email compromise and social engineering attacks are all financially impactful. Healthcare leaders need to be aware of the evolving cybersecurity threat landscape,” Hassold added.
Hassold added, “Moving forward, it’s important for healthcare organizations not to overthink cybersecurity. They need to have defenses in place to prevent initial access to their corporate network and invest in robust email security solutions like Abnormal Security that detect a wide range of email attacks and definitively safeguard employees’ inboxes.”
Photo: HYWARDS, Getty Images
