The US Department of Health and Human Services (HHS) has issued a warning regarding hackers targeting hospital helpdesks, posing a significant threat to health services across the country. These hackers are using sophisticated methods to gain access to critical hospital systems, putting patient data and financial information at risk.

According to reports, hackers are contacting hospital IT help desks using local area code phone numbers, pretending to be hospital employees, and providing stolen identification to gain the trust of helpdesk staff. They then request that their devices be set up to use the employee’s multi-factor authentication, allowing them to access internal systems and carry out malicious activities.

Hospital data and finances a honeypot for hackers

The Health Sector Cybersecurity Coordination Center (HC3) has highlighted the severity of the situation, urging hospitals to remain vigilant against these attacks. The hackers are resorting to elaborate social engineering tactics to target login information related to payer websites, enabling them to make unauthorized ACH changes and steal money from the hospital’s accounts.

HC3 revealed that threat actors have been impersonating hospital employees, including Chief Financial Officers, to manipulate payment processors and divert funds into their bank accounts. Additionally, the hackers registered a domain with a slight variation of the target organization to carry out these fraudulent activities.

To combat these threats, HC3 has provided guidance to IT help desks, including requiring callbacks for new device setups and password resets, monitoring ACH changes for suspicious activities, and training employees to recognize social engineering techniques and phishing attempts.

It is crucial for hospital staff to remain cautious and follow the recommended security measures to prevent falling victim to these cyberattacks. By staying informed and implementing necessary precautions, hospitals can safeguard their systems and protect patient data from malicious actors.

Source: BleepingComputer