Microminder Case Study – Sophisticated Phishing Bait
It was a busy Tuesday morning, and the practice receptionist had just received a worrying email. Marked as ‘urgent’, this email was ostensibly from HM Revenue and Customs (HMRC). The email claimed that an immediate tax payment was required to meet an end-of-financial-year deadline and avoid penalties. Feeling pressured by the nature of the email, and the implications of missing a deadline with HMRC, the receptionist decided in that moment to open the attachment.
To those of you who are familiar with Phishing scams, you might know what happened next.
This attachment contained a malicious programme known as ransomware. This programme automatically began running in the background, trying to wrest control of the computer from the practice, bypass security software, and encrypt over 1,200 patients clinical and billing records, effectively holding them hostage.
We often discuss the implications of a hack, when we talk about Microminder's services and it's the sheer amount of sensitive patient data we always emphasise. The billing and clinical records of 1,200 patients is a staggering thing to consider. The potential impact on the lives of those patients cannot be overstated, to say nothing of the potential damage the leak would do to the practice in question.
Which is why Microminder’s security response was so crucial.
How Microminder Responded
While the staff continued with their day, largely unaware of the attack, the Microminder Security Operations Centre (SOC) detected the infected computer attempting to communicate with a hacker's server. From there, the Microminder team followed a simple two-step process.
- Containment: Within 90 seconds of the file being opened, the team remotely "unplugged" the infected computer from the rest of the practice’s network. Because of this immediate action, the ransomware was trapped and could not spread to the central server where patient data is stored.
- Remediation: Microminder then remotely cleaned the affected computer. Confirming that no patient data was stolen or lost, and ensured the practice avoided the downtime and reputational damage of a major data breach.
Future-Proofing the Practice
Despite how well the hack was handled by Microminder security, the fact remains that the most effective means of keeping your practice safe is through prevention. To ensure the practice remained protected against similar threats in the future, Microminder implemented a robust, multi-layered security plan:
Network Segmentation: Microminder compartmentalised and reorganised the practice’s IT network. This meant that front-of-house admin computers, guest Wi-Fi, and the critical clinical database were all kept in separate "digital rooms". This way, if one computer was to ever become compromised, the rest of the practice would be safe.
Internal Security Assessment: Microminder performed a "stress test" (Penetration Test) to find any hidden gaps in the network that a hacker could use to get in. This way, those gaps could be sealed.
Comprehensive Cybersecurity Staff Awareness Training: Recalling what we said about prevention, ensuring staff are able to recognise phishing is a potent layer of protection from scams. To this end, Microminder provided ongoing cybersecurity staff awareness training for the whole team. Making sure that everyone working in-practice can recognise key signs of phishing or social engineering in an email.
Conclusion
Microminder's timely intervention in this case helped to prevent a data breach, and their ongoing support for the practice helped to ensure that the practice remained safe from hacks, ensuring the safety of the practice and its patients.
