Medicaid Data Exposed In Successful Phishing Attack

Thirty thousand records breached may not seem significant these days when we hear over and over about hundreds of thousands, such as with Equifax and into the billions with companies like Yahoo. But if you are one of the breach victims in a recent phishing attack in Florida, I’m sure the size of the breach really doesn’t matter. Data for 30,000 Florida Medicaid recipients was exposed to hackers after an employee of the states Agency for Health Care Administration was duped into falling for malicious phishing email message.

This occurred back in November of 2017 and resulted in exposure of a cornucopia of information such as names, addresses, medical conditions and diagnoses, as well as Medicaid identification numbers. That’s plenty of information to start with to commit fraud. For the victims, be sure to review all Medicaid statements and report anything suspicious to Medicaid for resolution. Healthcare fraud is costly and the more it happens, the more expensive healthcare will become for all of us. Also, be on the lookout for phishing attacks that include keywords that may have come from healthcare records. Follow the phishing identification guidelines to avoid giving out any more of your sensitive information:

• If a link or attachment is not expected, it should not be clicked without independent verification of its legitimacy from the sender.

• Don’t ever hit the reply option when trying to verify a link or attachment, whether it’s email or text. Independently ask the sender by a new email message or text, by using the phone, or in person.

• Just because the sender is known, it doesn’t guarantee anything included in the message is actually from that sender. It’s very easy to spoof email addresses and names these days.

• Even if it looks like a company’s logo and appears real, if it is not expected, verify it first.

• Keep an eye out for typos, incorrect grammar, and poor punctuation. Many phishing messages still include these little clues.

Phishing continues to be a real threat, both at home and in the office, and everywhere else we go. It is the primary way that cybersecurity measures are breached, and it only takes one person falling for one email to cause harm. It’s everyone’s responsibility to stop, read, and determine what action to take next. In many cases, and in all phishing cases, that action is no action at all.

Phishing no longer comes only in email messages either. In fact, the cybercriminals are getting wise to the fact that we really are learning to identify phishing attacks in email. So, while they certainly still do continue to use email, they also have increased their toolset to include text and SMS messaging, and the telephone.

Awareness training and education are really the best defense against phishing in any form, especially in the office. Training employees on current threats and mitigation on a continual basis is a key method for prevention and is the only realistic way to prevent successful phishing attacks. That’s because all the perimeter tools in the world, while still important and necessary, will not prevent an employee from clicking a link or attachment in an email if they aren’t trained on what to do.

Phishing can catch out anyone, especially when the day is filled with tasks that just seem impossible to finish in a day.  A comprehensive training and awareness program will help keep your employees from being hooked.