A new cybercriminal tactic targeting hospital IT help desks aims to access computer systems and divert payments by impersonating health system finance employees to request password resets and new device enrollments. The American Hospital Association (AHA) warns that once access is granted, these cybercriminals can bypass multi-factor authentication, access sensitive email accounts, redirect payments to fraudulent accounts, and insert malware. The AHA advises health systems to strengthen IT help desk protocols and employ verification methods like callback procedures, video calls, and ID verification to combat these social engineering attacks. The FBI has assisted in recovering payments if notified promptly, highlighting the ongoing threat this scheme poses.

Cybercriminals pose as hospital finance employees, divert payments Beckers Hospital Review

A Department of Homeland Security review, conducted by the Cyber Safety Review Board (CSRB), found that Chinese hackers, known as Storm-0558, accessed the emails of senior U.S. officials including U.S. Commerce Secretary and others, exploiting a series of security failures at Microsoft. The report, which scrutinized a 2023 incident affecting 22 organizations and 503 individuals worldwide, criticized Microsoft for a corporate culture that deprioritized security investments and risk management, leading to the breach. The hackers were able to infiltrate Microsoft systems and download approximately 60,000 emails from the State Department by exploiting operational flaws and obtaining a critical signing key, the origin of which Microsoft has yet to identify. The CSRB report, which also linked the hackers to previous significant cyber incidents, emphasized the need for Microsoft to overhaul its security culture and implement the recommended security improvements urgently to protect against nation-state threats.

DHS blames ‘cascade of security failures at Microsoft’ for China hack on US government The Record

In response to the rising cybersecurity challenges facing healthcare providers, highlighted by attacks like the one on Change Healthcare, Chris Van Gorder of Scripps Health advocates for a reevaluation of both the responsibilities and expectations placed on the sector. He criticizes the oversimplification of these issues by legislators and calls for updated, realistic cybersecurity requirements and more robust federal support to protect healthcare infrastructure against cyber threats. Van Gorder emphasizes the unique vulnerabilities of healthcare providers to cyberattacks, which not only incur significant financial losses but also put patient lives at risk, as demonstrated by Scripps Health's experience with a cyberattack in 2021. He proposes a four-pronged approach for moving forward, involving clearer government-led guidelines, protective measures for compliant organizations, funding for cybersecurity defenses, and a collective effort to reassess how healthcare cybersecurity is managed, stressing the necessity of safeguarding patient care from these evolving threats.

Contributed Content: 4 Ways Forward in The Aftermath of The Change Healthcare Attack HealthLeaders Media

Taylor Davis MS Stat MBA highlights the critical issue of rising healthcare costs managed ineffectively by insurance companies over the past 40 years, leading to excessively high hospital costs. He advocates for alternative solutions to cut healthcare spending by suggesting that employers and brokers consider implementing a secondary review for large medical bills and encouraging the formation of localized healthcare networks. These approaches aim to bypass traditional insurance company control, thereby reducing major medical expenses by 30-60% through employee-friendly Centers of Excellence and claims review. This strategy leverages local networks and thorough bill reviews to ensure employers only pay for necessary services, aiming to significantly lower healthcare costs without compromising care quality.

Taylor Davis on LinkedIn: 40+ yrs of health insurance control of healthcare costs LinkedIn