Cyberattacks in Wyoming Prove Size Doesn't Matter

Wyoming might seem rather remote to some. It doesn’t make the news often and it’s likely that many couldn’t find it on a map of the U.S. Its population is around 586,000. That’s fewer than in the 25 largest U.S. cities. However, recent events there prove that cyberattacks don’t discriminate based on location or population. Earlier this year Campbell County Health in that state was struck by a W-2 phishing attack; also referred to as business email compromise (BEC). Information on 1,625 of the organization’s employees were the victims.

In this case, the attacker posed as a high-ranking official of the hospital requesting W-2 information for employees with 2016 taxable income. Unfortunately, it was provided before the email was identified as fraudulent.

A similar request was sent around the same time to St. John’s Medical Center in Jackson, WY. In this case, the request was made to look as if it were from the CEO asking for a report of W-2 information. In 2016, Wyoming Medical Center fell for a phishing scam that resulted in the loss of information on 3,200 patients.

The steps that Campbell County Health took were formidable and commendable. It did what any organization that is breached should do and did not waste time doing it.

1. It immediately contacted law enforcement and hired a cybersecurity response team to investigate the incident.
2. It notified employees who were affected and recommended they keep an eye on their credit reports for suspicious activity.
3. It offered assistance to the employees by providing two years of Identity Theft Protection services through a leading identity protection services company.
4. It is providing in-house training on the risks and dangers posed by phishing, as well as fraud prevention and awareness.

The information in health records is a treasure trove of sensitive data that can be sold for $50 to $360 per record. It also provides a great opportunity for insurance fraud. The continued prevalence and success of W-2 phishing is likely to result in an increase in tax fraud. The IRS reported that in 2016, there were over 35,000 fraudulent returns filed. Just recently a new version of a BEC scam was discovered that combines W-2 fraud and wire transfer fraud. It’s easy to see why cybersecurity experts stress the importance of a comprehensive cybersecurity strategy.

Fortunately, healthcare related data was not taken in the Campbell County Health attack. But these cases do point out that the healthcare industry is becoming a hot target for cybercriminals. Every organization should take note and take action to protect itself. And if it should strike, they should take the lead of Campbell County Health in how they react to it.