Email attacks target the healthcare sector

A new report from Abnormal Security reveals a rise in targeted email compromise attacks on the healthcare sector.

Vendor email compromise (VEC) attacks on the sector have consistently trended upward, recording a 60 percent increase between August 2023 and August 2024. The sector's reliance on long-term vendor relationships is being exploited through VEC, where cybercriminals impersonate trusted vendors to bypass traditional email security and trick employees.

Over the same time period the number of phishing attacks on healthcare organizations also increased by 37 percent. With the help of tools like Google Translate and AI platforms like ChatGPT, attackers can create polished, grammatically correct, and well-written emails that are tailored specifically to their targets, making them harder to spot.

Mike Britton, chief information security officer at Abnormal Security, writes on the company's blog, "For healthcare professionals in particular, a high rate of turnover in larger healthcare organizations and hospital systems means employees are less likely to know their colleagues personally, making impersonation easier. Healthcare providers also often work in high-pressure situations with tight schedules and heavy workloads, which can lead to less scrutiny of emails and an increased likelihood of opening malicious messages."

Healthcare organizations are an attractive target for cybercriminals as they store lots of personal information which can sell for premium prices on the dark web -- medical records can be worth 20 percent more than credit card data. Also the consequences of an attack can be severe, which means that there's a greater incentive to pay ransom demands.

Outdated systems and policies not designed to counter modern cyber threats can also leave healthcare organizations exposed to evolving attack methods.

You can read more on the Abnormal Security blog.

Image credit: scanrail/depositphotos.com