UnityPoint Health is reporting that a data breach may have exposed nearly 1.4 million patient’s personal health data, and all of this is because of a phishing attack. Phishing, and especially spear phishing, attacks are one of the easiest ways for potential attackers to gain access to secure systems. Phishing attacks rely on both human and digital vulnerabilities because while email software has gotten better at detecting and stopping phishing attacks automatically it’s impossible to catch everything. It eventually falls on the human operator to make a judgement call about what emails they open and unfortunately, many people fall victim to malicious emails that have the potential to sweep up secure networks. An initial phishing attempt will be aimed at gaining access to a trusted email address within a system and then use the infected, and still trusted, email address to phish other users. Knowing how to spot suspicious emails is critical, and there are a few simple rules that can be applied to determine which emails to trust.
– Do you know the sender?
– Are there are any obvious misspellings or other simple errors that the sender should not have made?
– Are they asking for an immediate reply or one within a day?
– Is the sender contacting you on an email address that isn’t associated with who they’re claiming to be?
– Are there any hyperlinks in the email that show different addresses when you hover over them?
If the email seems suspicious, or you want to follow best practices, just call or contact the sender and confirm that they really did send you the email. This simple verification process can save you and your company time, money, and prestige by stopping phishing attempts in their tracks.
Source: Phishing attack compromised the data of 1.4 million UnityPoint Health patients
Joel Oritz is being accused of stealing $2 Million in cryptocurrencies by hacking into cell phones. In at least one case he did so by pretending to be the victim and purchased a new SIM card for the victim’s phone which was used to steal personal identifying information (PII). The PII was then put to work breaking into the victims crypto wallet so that Mr. Oritz could drain their cryptocurrency. Mr. Oritz’s victim count is a minimum of 20 in the state of California with more in other states; he is currently on bail and is charged with computer hacking, identity theft, and grand theft.
Source: Valedictorian allegedly stole $2M in cryptocurrency by hacking cell phones
A spearphishing attack originating from Russia targeted some 400 companies and at least 800 devices at these companies, which were various industrial businesses. Targeting these businesses has been a running theme for attacks coming from Russia lately, and in Ukraine, they’ve become so devastating that whole cities have been left without power or utilities. It was recently reported that the US electrical grid had been thouroughly hacked and while there was no loss of service, it wasn’t outside the realm of possibility either. The focus of this set of attacks was stealing money rather than control of espionage, which was accomplished by gaining access to high-level accounts.
Source: Russian spearphishing campaign targeted nearly 800 PCs at more than 400 companies
