In a recent Law.com article, “Lawsuits Over McKesson Voice-Phishing Attack Points to Ongoing Risk in Healthcare Sector,” F. Paul Greene, chair of Harter Secrest & Emery’s Privacy and Data Security practice, discussed the healthcare industry’s continued vulnerability to social engineering attacks and the far-reaching impact cybersecurity incidents can have across the sector.
The article examines the litigation facing McKesson Corp. following a cyberattack allegedly carried out by the criminal hacking group ShinyHunters. According to the report, the attackers claimed to have gained access to patient information through a voice-phishing, or “vishing,” campaign that targeted company employees. The incident has resulted in multiple class action lawsuits alleging that the company failed to adequately protect sensitive patient data.
Greene noted the significant role McKesson plays throughout the healthcare ecosystem and the broad consequences that may result when an organization with extensive industry connections experiences a cybersecurity incident.
“If McKesson sneezes, everybody in the industry gets a cold.”
Greene also observed that vishing attacks have become a persistent challenge within healthcare organizations, which often operate large and complex technology environments. As healthcare systems continue to expand, employees may find it increasingly difficult to distinguish legitimate internal requests from sophisticated social engineering attempts.
He emphasized that organizations should continue to invest in employee awareness training and reinforce basic security practices, including educating personnel that IT departments should never request login credentials through unsolicited phone calls. Greene further encouraged healthcare organizations to seek greater transparency from third-party vendors regarding the safeguards they employ to protect sensitive patient information.
While acknowledging the effectiveness of vishing campaigns, Greene noted that even highly sophisticated and security-conscious organizations can fall victim to these attacks, underscoring the importance of ongoing vigilance and continuous improvement of cybersecurity programs.