The Steps of Spearphishing and the Value of Stolen Data

In a survey conducted by the Identity Theft Resource Center (ITRC) of identity theft victims in 2014, only 16.4% of respondents completely trust their health insurance provider to use personal information they provide in a responsible manner. Most people only moderately trust them (29.7%).  Possibly, they have good reason.

There have been several data breaches involving health insurance companies over the past year including Excellus, Anthem, and Premera. These three breaches have affected approximately 100 million people so far. Another 18 million who were not customers may also have been affected by these. Tack on another 14 million if you add the UCLA Health System breach of this past summer.

Information has started to rise up as to how the breaches of at least two of these (Anthem and Premera) happened. Both lead to phishing and more precisely spearphishing. The latter is a type of phishing where employees or those “in the know” about a particular company or industry are specifically targeted by cybercriminals. Spearphishing may be more time consuming due to needed research, but it usually will result in a more lucrative payload. 

If you know the steps of a spearphishing scam, you are much more likely to not make your information readily available to the hackers and hopefully implement some internal policies to better identify legitimate internal emails containing links or attachments.

Step 1 - Criminals research a company's organizational structure. With all the information available on social media, a quick search on LinkedIn or Google will produce most of the data very quickly.

Step 2 - Once a criminal has the company structure, they now need to know what the executive's email looks like. Criminals set up a Gmail or Yahoo account and send a nice email over to the executive. All the criminal is trying to accomplish is to get a reply email to be able to replicate the look and feel.

Step 3 - Now that the criminal has the company structure and can mimic the executive's email, they send out emails to people in their direct food chain with a malicious link or attachment. Because the victims believe this is an urgent matter from their "boss", they are normally anxious to fulfill the request very quickly.

Step 4 - When the link is clicked or attachment opened, the malware is delivered to the company network. Once on the network, it will connect with the criminal's server and wait for instructions. 

The hacker will target your company's sensitive data to steal and sell it on the Dark Web. This is a multi-billion dollar industry and all trends point to this as one of the fastest growing and most lucrative crimes in the world. 

Each data record stolen has a price tag and that price is driven by how it can be used and the current supply and demand. Credit card numbers used to be the main target, but there is a glut of them and it is pretty simple to get a new card and end the usefulness of the stolen number. Social Security numbers and health care records are much bigger scores. A SSN stays with a person for life. Even if a person can prove to the US Government that their life has been ruined due to identify theft, the new number the victim is given ties directly to the old compromised number. Therefore the new number is of no help at all.

2

• Financial Institution Account Record: $80 (usually contains SSN)
• Heath Care Record: $80 (usually contains SSN)
• Social Security Number: $40
• Credit Card Number: $7
• User Name & Password to any Website: $2

In the case of health insurance companies, it is the identity theft motherlode. Health insurance companies store social security numbers, payment details, health histories, information on family members, and other data that is extremely valuable to cyber thieves.

More importantly, think about your company and what data is worth stealing. And then ask yourself if your company could survive if that data was stolen. Making a few changes in process and taking an extra few seconds to ensure the link or attachment is legitimate may be all you need to prevent an attack.