Top 10 Brands used in Phishing Attacks

by | Sep 5, 2019 | Business Associates & Others, General News, Physician Practices

Top 10 brands for phishing

Last week email security vendor Vade Secure published its quarterly Phishers’ Favorites report, which ranks the brands used by phishers.     These rankings are based on data obtained from users of its email security products.  It is important for practices to understand Phishing attack trends and techniques because phishing attacks are the #1 route for malicious software delivery.  According to another report, by email security leader Proofpoint,  77% of phishing attacks in the healthcare sector used a malicious url link instead of an attachment!.   Security awareness training is also required for HIPAA compliance.

Based on the Vade Secure report, the top 10 brands for the 2ndQuarter of 2019 are:

  1. Microsoft
  2. Paypal
  3. Facebook
  4. Netflix
  5. Bank of America
  6. Apple
  7. CIBC
  8. Amazon
  9. DHL
  10. Docusign

Microsoft retains its #1 ranking, with a whopping 20,217 unique phishing attacks identified in the quarter, which is an average of 222 per day.  Microsoft is likely the #1 favorite because of the popularity of its Office 365 product.  Gaining access to a company’s Office 365 assets is valuable for criminals.

Coming in at #2 is Paypal, the #1 online payment service worldwide.  Getting into Paypal is a rapid way to steal your money.

Facebook, at #3, has been surging in the rankings.  Vade Secure speculates that Facebook’s growing popularity is because Facebook credentials increasingly can be used to sign into many 3rdparty cloud systems.

The complete report is available from Vade Security here and is a good read.

Your HIPAA Security Risk Assessment almost certainly will identify Security Awareness Training as a top control to implement.  Organizations can use this list as part of the ongoing security awareness training program.  Employees should be taught to be especially vigilant regarding emails purporting to come from these top companies.   Best practices for Security Awareness Training include:

  1. Gain support from the practice owner and/or CEO
  2. Ensure that all employees participate, including and especially the physicians!
  3. A simulated email phishing attack against all employees should be conducted, and the number of employees who fail is recorded and used as a baseline to measure success of the program.
  4. Training / Security Reminders should be frequent (monthly or quarterly), brief
  5. The program should be fun, entertaining, interesting and engaging.
  6. Simulated phishing attacks should be ongoing. Results should be measured.  Remedial action should be taken to educate employees who are slow to assimilate.
  7. The program needs to be ongoing, not once-and-done.

While security awareness programs can be done completely in-house, some outside expertise and/or tools will usually improve the effectiveness of the program.

For details of the Security Awareness Program offered by Eagle Consulting Partners, please see Security Awareness Training .

You may also be interested in:

Pin It on Pinterest