The AHA has been made aware of a validated IT help desk social engineering scheme that uses the stolen identity of revenue cycle employees or employees in other sensitive financial roles. The scheme involves what is presumably a foreign-based threat actor calling IT help desks and leveraging stolen personally identifiable information of employees to answer security questions posed by the IT help desk. The threat actor then requests a password reset and requests to enroll a new device, such as a cell phone, to receive multi-factor authentication codes. This new device will often have a local area code. This effectively defeats multi-factor authentication, including SMS text and higher level “phishing-resistant” MFA, to provide full access to the compromised employee’s email account and other applications. The threat actor has reportedly used the compromised employee’s email account to change payment instructions with payment processors and divert legitimate payments to fraudulent U.S. bank accounts. As with other payment diversion schemes, it is believed the funds are ultimately transferred overseas.

“The risk posed by this innovative and sophisticated scheme can be mitigated by ensuring strict IT help desk security protocols, which at a minimum require a call back to the number on record for the employee requesting password resets and enrollment of new devices,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “Organizations may also want to contact the supervisor on record of the employee making such a request. As a result of becoming a victim of this scheme, one large health system now requires employees making such requests to appear in person at the IT help desk. This scheme once again demonstrates how our cyber adversaries are quickly evolving their tactics to defeat technological cyber defenses through social engineering schemes. It is also recommended that organizations that fall victim to any type of payment diversion scheme immediately notify their financial institution and the FBI at www.ic3.gov, which has proven to help recover the diverted payments if notification is made within 72 hours of the payment diversion.”

For more information on this or cyber and risk matters contact Riggi at jriggi@aha.org. For the latest cyber and risk threat information and resources visit www.aha.org/cybersecurity

Related News Articles

Perspective
This week’s cyberattack on Change Healthcare, one of the nation’s largest health care technology companies, is yet another unwelcome reminder of the…
Headline
A cyberattack Feb. 21 began disrupting systems and services at Change Healthcare, one of the largest health care technology companies in the United States,…
Headline
The U.S. Department of Justice, United Kingdom and other global partners have seized control of servers used by the LockBit ransomware-as-a-service group,…
Headline
Bryan Smith, recently retired chief of the FBI’s Cyber Criminal Operations Section, discusses the challenge of protecting the nation's caregivers and patients…
Headline
The National Institute of Standards and Technology this week released updated guidance to help HIPAA-covered entities and business associates assess and manage…
Headline
The FBI Feb. 15 released an alert to help organizations detect and reduce the risk of network compromise from the Warzone Remote Access Trojan, a malware…