Be Aware of New Phishing Impersonation Scam

A recent cyber scam has been targeting healthcare systems. Cybercriminals who have acquired employees' information are calling IT help desks impersonating employees. Their goal is to get access to the employees' email accounts and direct deposit information.

Protect yourself: Never share your password or multi-factor authentication information. Our Technology Service Center will never ask you for this information.

How the Attack Works:

1. Impersonation calls: The attackers call the help desk, pretending to be employees of Carilion. They provide sensitive details like Social Security numbers, badge numbers and demographic data to make their impersonations convincing.
2. MFA Enrollment: They try to convince help desk attendees to enroll a new device for multi-factor authentication (MFA) by claiming their phones are broken and they cannot log in or receive MFA tokens. If successful, they gain access to the impersonated employee's email account.
3. Domain Spoofing: In some cases, the attackers register domains spoofing our organization and create accounts impersonating our executives.
4. Payroll Changes: After gaining access to an employee's account, they submit direct deposit changes to paychecks.

Protect Yourself and Our Organization:

1. Verify Caller Identity: Always verify the identity of someone calling you for information. If you are unsure, end the call. Report suspicious calls and emails to our Information Security team at Office_of_Information_Security@carilionclinic.org.
2. Be Cautious with Personal Information: Never share your password or MFA details over the phone or email. Our Technology Services Group will never ask for this information.
3. Check Your Paycheck: Regularly check your information in My Total Access for any unauthorized changes or suspicious activity. Report any discrepancies to Information Security team at Office_of_Information_Security@carilionclinic.org.
4. Stay Informed: Be aware of common phishing and impersonation tactics.

If you have questions, email our Information Security team at Office_of_Information_Security@carilionclinic.org.