Cyber crime schemes to watch for and the warning signs that should prompt a second look
Cybercriminals are increasingly using social engineering tactics to pressure busy health-care staff into sharing sensitive information.
Social engineering – attacks that use manipulation and deception to trick users – is now considered one of the most effective ways to compromise systems, according to the Canadian Centre for Cyber Security. Often, these attacks are even more successful than advanced technical exploits.
This can result in breaches that expose patient health information, disrupt clinic operations, cause financial losses and more.
To learn more about how Ontario physicians can protect their practices, we spoke to Greg Moshonas, vice-president of cybersecurity and foundational services at Ontario Health, and Ariane Siegel, general counsel and chief privacy officer at OntarioMD.
Business email compromise and invoice fraud are common schemes that target physician practices, says Moshonas. This involves attackers impersonating trusted vendors or compromising email inboxes to redirect payments.
Credential theft and ransomware are similarly frequent. In these attacks, cybercriminals steal login credentials to access systems, steal data, disrupt operations and extort organizations.
AI-enabled impersonation is also a rising threat. Criminals use AI technology to create convincing emails, or deepfake voice messages or videos to impersonate a trusted source, such as executives, physicians, vendors or staff.
University Health Network recently warned about fraudulent videos circulating on social media that appear to show UHN physicians and nurses promoting health products. It also flagged AI-generated videos that misuse their brand and logo to make false health claims.
Ransomware attacks often come via phishing emails, says Siegel. These are designed to trick the receiver into revealing information or taking a certain action.
A common scenario begins with an initial, realistic-looking phishing email that could appear to come from a vendor, colleague, physician or lab.
The recipient follows a link or enters their credentials, allowing the attacker to access an email account or other communication channel. They can then study real communications to learn how the organization operates.
“Scams tend to have a little more information about you. That's why they're more successful,” says Siegel.
They can then use the compromised account to make further requests, gain access to other accounts, download spyware to monitor user activity and potentially damage other systems.
Urgency or threatening language are often characteristics of phishing emails, says Siegel. The messages often try to push you into immediate action to bypass normal, rational thought processes and procedures.
Common warning signs include requests for passwords or password resets, multi-factor authentication approvals, patient information or remote access to your desktop. Payments, changes to your payroll or banking, and software installation are other targets.
Be wary of unexpected links or attachments, as well as requests coming from unusual channels or unfamiliar contacts, those asking to bypass normal approval structures, and those containing spelling mistakes or unusual wording or tone.
If you receive a suspicious communication, pause and verify it through a trusted, independent channel, says Moshonas.
If in doubt, report the suspicious message to your IT department or established cybersecurity contact.
Use multi-factor authentication, keep systems up to date and regularly back up critical data.
“Creating a culture where employees feel comfortable reporting concerns and verifying unusual requests can be just as important as any technical security control,” says Moshonas.
To learn more about how to protect yourself, your patients and your practice, OntarioMD offers accredited privacy and security training.