2025 Foundational Application of Social Engineering

Phishing Attacks Targeting Healthcare Organizations: Social Engineering News

Phishing Attacks Targeting the Healthcare Sector

Share This Post

At an average cost of USD 10.93 million, healthcare has the highest data breach costs of all industries. Healthcare organizations are now reporting data breaches at a rate of around two per day. In contrast, just four years ago they were reporting data breaches at half that rate. How are cyber threat actors gaining access? The Health Sector Cybersecurity Center has named phishing as a leading cause in these data breaches. Indeed, phishing attacks often give threat actors the entry point they need to steal credentials allowing them to access accounts holding sensitive data. With this in mind, let’s look at two notable phishing attacks that targeted healthcare organizations this year.

Phishing attack leads to data breach affecting 168,000 patients at Henry Ford Health

Henry Ford Health notified 168,000 patients that an unauthorized individual gained access to employee email accounts that held protected health information (PHI). A spokesperson for Henry Ford Health said the unauthorized access occurred after employees responded to phishing emails. A review of the email accounts confirmed that they held the following patient information: name, date of birth, age, gender, telephone number, medical record number/ internal tracking number, lab results, procedure type, diagnosis, and date(s) of service.

Phishing attack targets Highmark Health affecting 275,000 individuals

A Highmark Health employee disclosed their credentials to an unauthorized individual after clicking a malicious link in a phishing email. The unauthorized third party was then able to access the employee’s email account remotely, potentially viewing and exfiltrating emails and attachments. A review of the emails and attachments revealed they held the PHI of health plan members.

Test. Educate. Protect. – Social-Engineer’s Managed Phishing Service

The financial cost, legal ramifications, and reputational damage, resulting from a data breach can be devastating. As we’ve seen, threat actors are using phishing, a social engineering tactic, as an entry point to steal credentials giving them access to accounts holding sensitive data. In view of this, security awareness training should teach your workforce to recognize and report potential phishing emails. At Social-Engineer we focus on human-to-human social engineering.  Our fully managed phishing service deploys Human Risk Analysts who are professionally trained and certified social engineers. With our managed phishing service, you’ll receive our expert analysis. Let the experts at Social-Engineer enhance your security awareness program. Please contact us today for a consultation.

You May Also Like

Vishing Attacks Targeting Healthcare Organizations.
SMiShing Attacks Target the Healthcare Sector

More To Explore

The growing danger of callback phishing
Phishing

The Rising Threat of Callback Phishing

The cybersecurity landscape is constantly evolving, with new threats emerging at an alarming rate. As technology advances, so do the methods used by cybercriminals as they employ more complex and

The Rise of AI Enabled Social Engineering Attacks
Artificial Intelligence and Deep Fakes

The Rise of AI-Enabled Social Engineering Attacks

In 2025, artificial intelligence will be a key focus for cybersecurity analysts and professionals. AI-enabled social engineering attacks are ushering in a new era of cybersecurity threats. Using advanced machine