Cyber Threats on the Rise; Take Steps to Protect Your Pharmacy!
Cybersecurity attacks are an unfortunate fact of life for businesses of all sizes. Email-based attacks are one of the most prolific methods hackers use to take advantage of users.
Many small businesses – including independent pharmacies – believe they are “too small” to be a target of these threats. The truth is that hacking is easier than ever and with AI and automation tools, no one is safe. There are entire call centers dedicated to ripping off people, and they don’t care if it's $500 or $500,000.
The Scam
APCI IT personnel are seeing a particular scenario playing out with various types of businesses. For example: Pharmacy A’s email was compromised without their knowledge. The hacker is seeking accounting information and has several options to get the information they want. They can: 1) Send phishing emails to the pharmacy’s contact list to find the right target; or 2) if they are in the right place, observe email communications until the right email comes through.
When the hacker finds the right target, they will send convincing emails to the contact list asking to update bank information. The hacker will then intercept the email communication, hiding it from the email account owner, and supply their bank account information. This can go on for months if there is no communication between the clients. The result: The pharmacy loses thousands of dollars, with no recourse, and the hacker laughs all the way to the bank.
Prevention Measures:
There are multiple ways APCI members can avoid this scenario. The most important takeaway is that it can happen to you, so you must be aware of these types of cybersecurity threats.
Here are some preventative measures:
- Second Factor Confirmation: Always get a second-factor confirmation from anyone asking you to update bank account information. Call them directly.
- Monitor Receivables: Closely monitor your receivables (rebates, insurance payments, etc.) to ensure the money owed is reaching your bank account.
- Recognize Suspicious Activity: Look out for any unusual or unexpected requests, especially those involving sensitive information or financial transactions. If something seems off, always verify the request through a different communication channel.
- Implement Strong Passwords: Use strong, unique passwords for your accounts. Avoid using easily guessable information such as birthdays or common words.
- Enable Multi-Factor Authentication (MFA): MFA adds an extra layer of security by requiring more than one form of verification to access an account. Please enable MFA on all accounts where it is available.
- Be Cautious with Emails: Be wary of emails from all senders, and do not click on links or download attachments from suspicious emails. Verify the authenticity of the sender before taking any action.
- Regular Training: Participate in regular cybersecurity training sessions. Staying informed about the latest threats and best practices is crucial in protecting our organization.
- Report Incidents Promptly: If you suspect a security incident, report it immediately to our IT department. Quick reporting can help contain the threat and minimize damage.
This is an unfortunate scenario that has happened to many and serves as a stark reminder that cybersecurity is not just an IT issue – it is a collective responsibility that involves every one of us.
Stay vigilant and protect your business.
Back to top