The biotechnology & pharmaceutical industry faces an increased risk of cyberattacks
The coronavirus outbreak has led to the rapid digital evolution of the healthcare industry. This has resulted in an incredible increase in hacking attacks and disinformation. Digital espionage against the healthcare sector, pharmaceutical agencies, and vaccine manufacturers has stepped up in recent months. With more data than ever collected and managed online, pharmaceutical organizations became very appealing to cybercriminals, and for good reason. Hardly any other industry has access to data with that level of critical sensitivity. A breach would mean stolen intellectual property and clinical trial data, reputational damage, revenue loss, etc.
Phishing campaigns and COVID-19 scams are more prevalent than ever.
The DynaRisk intelligence team has detected hackers offering fake applications associated with Coronavirus - trackers, maps, etc.
Prescription drugs, vaccines, even saliva and blood samples infected with COVID-19 also can be found available for purchase through the Dark web forums.
Cybercriminals exploit the pandemic to perpetrate phishing attacks, often posing as government and official health organizations. Online scammers will try to take advantage of the pandemic situation by sending fraudulent emails encouraging you to click on malicious links or open attachments. Any funding appeal that appears to be sent by the World Health Organization (WHO) is most likely a scam. WHO will never ask for your login information, send email attachments, charge a fee to apply for a conference, employment, etc.
Lotteries or prize giveaways also indicate a scam. Hackers will try anything that looks catchy enough for people to click on it. One click and voilà - you've got yourself a nice malware.
The WHO, the Gates Foundation, and the Wuhan Laboratories were subjected to a hacking attack that led to leaks of the user passwords.
The pandemic affected everyone financially and even cybercriminals have had to adapt to the situation. The screenshot above shows hackers offering a discount to entice more buyers.
Free Download: Ransomware Guide for SMEs
The Healthcare industry has been overwhelmed with implementing technical solutions to navigate the Covid-19 crisis and maximize efficiency. Relying on third-party vendors, automation tools and outsourcing moved cybersecurity issues to a whole new level. Many pharmaceutical companies still fail to set even the basic steps in terms of employee behavior online. It is a common error for employees to browse the Internet using corporate computers and domains. There are concerns many of them have even used company provided email addresses corporate domain to register on different forums or unknowingly access hacked websites, leaving the access to the company's database out in the open.
The DynaRisk intelligence team was able to locate, access, and download a large number of different leaked databases, but the hackers did as well.
DynaRisk detected numerous examples of information leakage following cyberattacks against the European Medicines Agency (EMA) in December 2020. In mid-January 2021, the EMA confirmed that some of the data associated with the Pfizer/BioNTech COVID-19 vaccine and the Moderna vaccine had been stolen. Hackers altered some of the email correspondence related to the vaccine evaluation process before its release. This type of data tampering undermines public confidence in COVID-19 vaccines. Fear sells.
Our early warning Hacker Chatter monitoring has tracked down a Pfizer FTP server in Spain with stolen credentials shared between hackers in a data cache with many other businesses. We detected messages posted on Russian forums with lists of thousands of other FTP servers, easily accessible by hackers since employees were using private identifiers, as well as the Pfizer domain.
Over the years, Pfizer has suffered several security breaches and data leaks. The released information remains available on forums to this day.
The DynaRisk intelligence team has noticed the leaked data concerning two other leading vaccine makers – Moderna and AstraZeneca. Stolen user’s credentials are shared on the Dark web forums and sold on a black market. Weak passwords always play a big role in corporate cybersecurity. One of Moderna’s employees has even used the company’s name as his password.
A great percentage of breaches can be attributed to human error. Healthcare employees lack training when it comes to cyber awareness. Using safe cloud services is more important than ever with the increasing number of devices connected. The Internet of Things (IoT) enabled the use of personal IoT devices in the workplace causing a number of security challenges.
The healthcare sector has been hit hard by cybercrime, and because it is such a vulnerable industry, the impact will go far beyond financial loss and invasion of privacy. Ransomware can make files and systems in-accessible until a ransom is paid. This leaves hospitals and health centers cut off from essential systems and unable to fully operate on a day-to-day basis. But there's still paper and pen. Not good enough for 2021.
DynaRisk offers strategies for fighting against cybercrime and ransomware attacks. We have created a range of tools to help companies improve their online safety and give you a heads up when you need to improve your protection.
Download our Ransomware Guide for SMEs to find out more about this critical thread and sign up for a free trial of Breach Defence to check if your company could be exposed.
· Types of ransomware attacks
· Ransomware examples
· The costs of a ransomware attack
· The ways your business may be vulnerable
· Preventing a ransomware attack
· Common mistakes when planning ransomware prevention
· Recovering from a ransomware attack