Employee Gives Up Credentials For Email Account Putting CareFirst Members At Risk

Attacks on healthcare companies are still happening. In this case, however, it may not have been the healthcare company that was targeted, but an email account that could be used for a spam campaign. But that doesn’t mean information of CareFirst Blue Cross Blue Shield members was not accessed or used. It just means it may not have been the end goal.

CareFirst determined on or around March 12 that the email account information of an employee was compromised and was subsequently used to send out spam messages to a list of others who were not associated with CareFirst. However, since the hacker had access to an employee’s email, he, she, or they also had access to information of 6,800 members. The information potentially at risk includes names, birthdates, member ID numbers, and some social security numbers.

This attack worked because of phishing. One employee clicked a link or attachment that asked for email credentials. The credentials were used for something that while still quite devious, could have been much worse. Instead of using the attack to send out messages, it could have been used to drop malware on the system or onto the entire network. That malware could have been ransomware, causing the system to lock up until ransom was paid. In this case, CareFirst got “lucky.” It’s a reminder that it only takes one person to cause damage.

Those who are members of CareFirst are encouraged to take advantage of the free credit monitoring service being offered. However, they do state there is no evidence of wrongdoing with the data. When signing up, keep in mind that it won’t prevent someone from stealing your identity or from opening accounts with your information. However, these services will alert you when someone tries.

Also, if you have frozen your credit (as many did after the Equifax breach), these services are not of use. That’s because they need to access your reports in order to detect if something changes. So, you can unfreeze your credit or just have faith the freeze is working. Remember there is most likely lag time and possibly a charge for this and for re-freezing it. Check with the bureaus to find out what these are in your state.

In addition, if you already have one of these services looking out for you, considering waiting till that one expires, then start the newest one. There is usually a timeframe set to take advantage of these services, but it’s usually several months or up to a year depending on the incident.