# data[].attributes.attachment_link.title
Uber hack linked to hardcoded secrets spotted in PowerShell script

# data[].attributes.attachment_link.description
Social engineering attack compromises internal networks and Uber’s bug bounty reports

# data[].attributes.attachment_link.provider_name
The Daily Swig | Cybersecurity news and views

# data[].attributes.attachment_link.readable_text
Jessica Haworth 20 April 2022 at 13:31 UTC
Updated: 20 April 2022 at 13:33 UTC

Phishing, malware, and spam are popular techniques deployed by attackers

A new report released today reveals that UK government employees receive an average of 2,400 malicious emails per year, as cybercriminals continue to use email as their vector of choice.

The study, from Comparitech, found that the central government departments across the UK received an estimated 2.6 billion suspicious emails in total last year.

These findings were taken from Freedom of Information (FOI) requests sent to 258 public-sector and national organizations including central government departments, the National Health Service and Network Rail.

"Across just under 260 government organizations, we estimate that 764,331 government employees received a total of 2.69 billion malicious emails in 2021," the report reads.

Comparitech notes that it defines malicious emails as containing either malware (including ransomware), phishing, or spam.

Malicious findings

An average of 0.32 percent of the malicious emails were opened by staff in 2021, meaning 8.62 million malicious emails were at least previewed. Of those opened, less than 1% (57,736) of these malicious emails resulted in staff members clicking on suspicious links.

Comparitech noted that "some" government departments responded with additional historical data, which showed that the years 2018 to 2019 saw an average increase in malicious emails of 24.5% (or around a quarter).
Read more of the latest security news from across the UK
From 2019 to 2020, this jumped to an increase of just over 146% - more than doubling. From 2020 to 2021, the rate slowed again to just over 16%.

"It's perhaps no surprise that the biggest increase coincides with the pandemic and most people working from home (and emails, therefore, being their predominant method of communication)," Comparitech noted in the study.

The company also noted, however, that central government departments with high volumes of malicious emails "aren't necessarily that bigger targets for hackers or have 'weaker' security systems".

"Rather, their IT systems may be doing a better job at filtering out malicious emails," the report states.

Critical targets

NHS Digital had a total of 357 million malicious emails received by 3,996 employees, equating to 89,353 emails per employee.

Other critical infrastructure services such as railway provider Network Rail Limited received 223 million malicious emails received by a total of 44,356 employees, at a rate of 5,033 emails per employee, while tax department HM Revenue & Customs received 27.9 million malicious emails received by 67,267 employees, or 415 emails per employee.

Scattergun

Paul Bischoff, privacy advocate at Comparitech, told The Daily Swig that government employees are targeted because "they often work for critical services and systems that can't afford to go down for long".

"That makes some government agencies more likely to pay ransoms, especially those in healthcare where lives are on the line," Bischoff added.

"Governments also have a lot of employees and not all of them are trained to spot phishing emails. Attackers can target a large number of employees to increase their chances of success.

He advised: "Every government employee who uses the internet for work, has a work email address, or connects to government networks should be trained to spot and handle phishing emails. Phishing is more of an operational problem than a cyber security one."

YOU MAY ALSO LIKE Critical infrastructure entities on red alert over 'exceptionally rare and dangerous' ICS malware

# data[].attributes.attachment_link.title
UK government employees receive 'billions' of malicious emails per year - report

# data[].attributes.attachment_link.description
Phishing, malware, and spam are popular techniques deployed by attackers

# data[].attributes.attachment_link.provider_name
The Daily Swig | Cybersecurity news and views

# data[].attributes.attachment_link.readable_text
Adam Bannister 25 March 2022 at 14:21 UTC
Updated: 28 March 2022 at 14:18 UTC

Medications and test results among data potentially 'previewed' by attacker

UPDATED The sensitive medical data of more than 1,200 Washington residents has been exposed after a successful phishing attack against a local public health agency.

Spokane Regional Health District (SRHD) said that "files containing client protected health information" associated with 1,260 individuals and two departments may have been "previewed" by an attacker during the incident on February 24, 2022.

However, "the investigation did not find any documents had been opened, accessed, or downloaded", said SRHD in a data breach alert issued yesterday (March 24).
Catch up on the latest healthcare breaches and security news
SRHD said 1,060 individuals may have had their first and last names, initials, dates of birth, and various medical data compromised. Health-related information exposed included test results, medications and prescription reasons, medical referrals, client notes, and delivery dates for pregnancies, among other data.

The other 200 victims potentially had their first and last names, initials, dates of birth, phone numbers, "shelter locations", test dates, and notes exposed.

Although neither Social Security numbers nor financial information were involved, "those affected are encouraged to monitor their bank accounts and report any suspicious activity immediately", while 'explanation of benefits' statements should be "monitored for possible ID theft activities", according to SRHD.

Potential victims have been notified of the breach, added the healthcare provider.

Phishing spike

SRHD said it had "implemented appropriate corrective actions" to prevent further breaches, related to cybersecurity training, use of multi-factor authentication (MFA), and testing related systems.

"Much like the rest of the state of Washington, SRHD has experienced a record-level spike in phishing emails and malware installation attempts," said Lola Phillips, deputy administrative officer at the SRHD. "In this instance, staff fell prey to a phishing scam which exposed confidential information to data thieves.

"We have a strong commitment to safeguard your personal information, and we are working diligently to reduce the likelihood of future events."

In response to an invitation to comment further, SRHD told The Daily Swig:

"Since our staff are our first line of defense, we are focusing on giving them the tools they need to recognize and thwart future attempts. We are beginning the roll-out of Drip7, a required four-part cybersecurity training for employees that focuses on recognizing social engineering, phishing specifically, password creation and protecting privacy. The program includes regular communication with staff throughout the year on cybersecurity topics and several test phishing attempts throughout the year.

"Keeping up with the increasing data breaches that are taking place throughout our state, especially against health care organizations, has been challenging. But we will meet that challenge with increased employee education and continued monitoring and system updates to better capture fraud attempts before they hit in-boxes."

One of 34 local public health agencies in Washington state, Spokane Regional Health District serves a population of more than 400,000 in Spokane County.

This article was updated on March 28 with additional comment from SRHD.

DON'T FORGET TO READ Okta investigates LAPSUS$ gang's compromise claims

# data[].attributes.attachment_link.title
Washington residents' medical data exposed by phishing attack on Spokane Regional Health District

# data[].attributes.attachment_link.description
Medications and test results among data potentially 'previewed' by attacker

# data[].attributes.attachment_link.title
What is Social Engineering in Cyber Security? Explained

# data[].attributes.attachment_link.title
This is how hackers hack you using simple social engineering