Emails landed in the inboxes of employees at several Massachusetts hospitals, seeking COVID-19 statistics for the Department of Health and Human Services.
On the surface, the notices seemed innocuous, a chance to assist in the fight against the devastating coronavirus pandemic. Except for this: The emails were a hoax — and a dangerous one at that, according to a report in the Boston Business Journal. The phishing emails sought illegal access to the hospitals’ systems. Such emails — which often seem work-related, credible and innocent — can ultimately compromise data, lock down hospital systems and potentially disrupt patient care. And they also can endanger the job security of employees who fall victim to such schemes.
With the recent barrage of cyberattacks, federal agencies have urged extreme diligence, particularly at health care facilities. While attacks against other industries jumped 22 percent between Nov. 1 and the beginning of January, attacks against global healthcare organizations surged 45 percent, according to a report by Check Point Software Technologies Ltd. The average number of weekly attacks against each healthcare organization: 626, up from 430 in October.
Closer to home, the Sonoma Valley Hospital shut down its systems upon detection of an October ransomware cyberattack that targeted dozens of hospitals nationwide. Such attacks seek to encrypt and lock down systems, saying they’ll return the information only if paid.
The incidents put businesses and employees in awkward situations — self-reporting helps tremendously, but employers also struggle with whether workers need to be disciplined for not exercising more caution. Couple that with the fatigue and stress of pandemic-disrupted work environments and caring for COVID-19 patients, and employees have their hands full.
The best way to stay out of trouble is to avoid falling for cyberattack schemes in the first place. Here are some tips:
- Be suspicious of any links in emails. Cyberattacks have become more difficult to spot, often masquerading as potentially important or very innocent notices. Requests for personal information likewise should put you on guard. If in doubt, separately email someone who would know whether the request or link was legitimate before clicking or responding in any way.
- Be extra careful on weekends and holidays. According to Check Point, ransomware attacks have concentrated on times with lighter IT and security staff.
- Follow all protocols from your IT staff. If you’re supposed to shut down your computer every night, do so. If you’re supposed to perform any updates that pop up, do so — even if it delays your work a bit.
Even the federal government has been so concerned about cybersecurity risks that it recently transferred oversight of the .gov domain from the U.S. General Services Administration to CISA, citing a desire to make the domain more secure and to keep “malicious actors” from impersonating it.
If you’re coping with a difficult work situation and need a skilled advocate, Keller Grover offers free consultations to advise workers about their specific situations. In more than 25 years litigating fraud and employment cases, the lawyers at Keller Grover have recovered hundreds of millions of dollars for clients and class members.