Health systems warn of coordinated phishing targeting Epic’s patient portal
Numerous health systems across the country have issued alerts, warning patients to ignore scam messages that are attempting to phish passwords from patients, allowing hackers to gain access to Epic Systems’ MyChart patient portal.
The effort appears to be coordinated by a single cybercriminal or a group, as more than a dozen facilities have issued similar warnings after receiving reports of emails that offer patients a chance to claim a “reward,” in the form of a “MyChart Medicare Kit.”
Notably, the scam emails resemble the spam many people receive every day from hackers pretending to be retailers, banks and more.
While the email congratulates the “winners” of the health kit, the health systems want patients to be aware that no such gift exists.
Given the target appears to be seniors, it’s unclear if the scammers are targeting Medicare enrollees, or if patients whose records are in Epic are being targeted more broadly. It also isn’t clear how the hackers got the contact information of patients in the first place, but there is so much stolen healthcare data posted for sale or leaked to the dark web, it isn’t hard to imagine a scenario where email addresses were very easy to obtain.
Look for clues
The emails appear to come from MyChart itself, but there may be giveaways that the emails are fake, including a nonsensical return email address and spelling mistakes, according to a statement released by Texas Health, whose patients have received the messages.
The example above, posted by Texas Health, may vary. The health system asked its patients to mark them as spam and to not click on any of the links within in order to help keep their accounts secure.
Clicking the reward link and “logging in” likely takes patients to a fake website, where scammers are looking to get credentials and collect sensitive data that could be used to steal identities.
A number of other health systems across the country, including Ohio’s Premier Health and Sentara Health in Virginia, have released similar warnings.
Epic has not commented on the scams. HealthExec reached out to the EHR vendor for more information.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.