Email phishing is the primary attack vector for 90% of health data breaches.
Hackers continue to get access to healthcare employees’ email accounts, leading to breaches in personal health information. The most recent victim, Regional Cancer Care Associates (RCCA), sent a notice of a data privacy event last week to inform patients that hackers accessed certain personal and protected health information from employee email accounts.
RCCA became aware of suspicious activity from an unauthorized party on May 24. The cancer care center then investigated to confirm the security of its network and learn more about the event. With the help of third-party forensic investigators, RCCA learned that it was the victim of unauthorized access to several employee email accounts between April 17 and June 4.
On July 16, the group confirmed that certain personal and protected health information were in the email accounts that were accessed.
Inside Digital Health™ made several attempts to reach RCCA to learn more about how many patients were affected and the details of the attack, but those requests went unanswered.
Although RCCA Group has no evidence that the hacker misused information found in the email accounts, the attackers could have access to the patients’:
And for a subset of patients, the following types of information were also included in the email accounts:
“We are keenly aware of how important personal information is to our patients and are strongly committed to our responsibility to protect all data entrusted to us,” the notice said. “We are continuously taking steps to enhance data security precautions.”
The login credentials for the affected email accounts were changed to prevent further unauthorized access.
The group is augmenting security controls and implementing additional controls, including the use of multi-factor authentication to prevent employee emails from unauthorized access.
Affected individuals will also have access to complimentary credit and identity monitoring and identity restoration services.
Phishing attempts have been prominent in healthcare and represent 93% of data breaches today, according to one report. Email phishing is the primary attack vector for nine out of 10 cyberattacks because it’s not readily detectable by traditional email security tools.
But there are ways to protect data from spoofing attacks.
Health systems should add more layers of security in the email mailbox. This security uses self-learning technology and detects attacks faster than the technology deployed at most hospitals.
It is also important to develop social media standards, because many employees involuntarily give away about 80% of the information needed to develop a spoofing attack.
And, of course, training is essential for health system employees, especially given the intricate and sensitive data being collected. Employees need to know what to be aware of how an attack can happen and the consequences of such attacks.
Get the best insights in digital health directly to your inbox.