Healthcare companies experienced a 300 percent increase in impostor email attacks between the first quarters of 2018 and 2019, a new report found.
According to Proofpoint, healthcare organizations received an average of 43 impostor emails during the first quarter of 2019. This constituted a 300 percent increase in impostor email attacks over the same quarter in the previous year. Of affected healthcare organizations, 95 percent were hit with email spoofing of their own trusted domains; on average, 65 people received spoofed email messages.
A deeper dive into the attack emails revealed that subject lines containing the words “payment,” “request,” “urgent” and related terms appeared in 55 percent of the fake emails. In addition, 77 percent of attack messages arrived with malicious URLs. Attackers used this tactic and others to target healthcare entities primarily with banking Trojans.
Email and Malware Attacks in the Healthcare Industry
Bad actors are increasingly launching email attacks to prey upon healthcare organizations. Proofpoint disclosed in February 2019 that the average healthcare organization suffered 96 email fraud attacks in Q4 2018, up 473 percent from the beginning of 2017.
Cybercriminals leveraged those attack emails and other techniques to deliver various malware, but as revealed by Verizon in its “2019 Data Breach Investigations Report (DBIR),” ransomware accounted for 70 percent of all malware incidents that affected this vertical during its data collection period.
Unfortunately, these ransomware attacks didn’t slow down over the next few months. Emsisoft found that healthcare providers weathered 491 ransomware attacks between Q1 and Q3 2019, which comprised about 79 percent of ransomware incidents encountered by all industries during that same time period.
How Can Healthcare Companies Defend Against Email Attacks?
Security professionals can help healthcare organizations defend against email attacks by investing in email security tools to eliminate obvious phishing emails and similar attacks before they arrive in employees’ inboxes. Organizations should also implement mandatory security awareness training to educate users about malicious attachments and links commonly found in attack emails.