{"id":54180,"date":"2023-10-18T16:07:47","date_gmt":"2023-10-18T16:07:47","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/35139\/FBI-Cybercriminals-Targeting-Plastic-Surgery-Offices-And-Patients.html"},"modified":"2023-10-18T16:07:47","modified_gmt":"2023-10-18T16:07:47","slug":"fbi-cybercriminals-targeting-plastic-surgery-offices-and-patients","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fbi-cybercriminals-targeting-plastic-surgery-offices-and-patients\/","title":{"rendered":"FBI: Cybercriminals Targeting Plastic Surgery Offices And Patients"},"content":{"rendered":"
\n
\n
\n

A recent report issued few hours ago, indicates that office of plastic surgeons, and their patients are major targets for threat actors, with intents to harvest PII-Data (Personal Identifiable Information).<\/p>\n

In a recent FBI alert (Alert-Number: I-101723-PSA)<\/strong><\/a>, shocking revelations unfold as threat actors were identified to be raiding plastic surgeon\u2019s offices for precious medical records and patients\u2019 intimate photographs.<\/p>\n

The FBI stated that:<\/p>\n

\u201cOnce successful, cybercriminals use social engineering techniques to enhance the harvested data and extort individuals for cryptocurrency.\u201d<\/p>\n

 <\/p>\n

 <\/p>\n

\"Cybercriminals-craving-financial-facelift-targets-plastic-surgery-offices-and-patients.png\"
                                                                                                                 FBI: (Alert-Number: I-101723-PSA). Image-source: FBI<\/figcaption><\/figure>\n

 <\/p>\n

 <\/p>\n

The FBI categorized this as a scam, that comprises of three phases:<\/h2>\n

Analysing the situation, The FBI categorized this cyberattack as a scam, that comprises of three phases.<\/p>\n

The first phase involves data harvesting, whereby the threat actors utilize spoofing techniques to disguise their phone numbers, emails, and then successfully lunch a phishing attack that deploys hidden malware to the targeted plastic surgeon office. Immediately the malware has successfully infected the device belonging to the surgeon, the threat actors then proceeds to harvest the electronically protected Information (ePHI).<\/p>\n

The Second phase involves enhancing the data. With the use of open source intelligence tools, and social engineering techniques, the threat actor enhances the ePHI belonging to patients of the compromised surgeon, and proceed to the next stage which is extortion.<\/p>\n

The third stage notable shows that the cybercriminal uses various means such as social media accounts, emails, text messages, and other messaging apps to contact both the surgeon, and the patients. An act of urgency and pressure using social engineering is placed across the surgeon and patient stating that if the demands are not met, that these information\u2019s obtained would be made public to both victim\u2019s (patient and surgeon) friends, family, and colleagues. However, if there demands were met, that they would discontinue the ePHI.<\/p>\n

 <\/p>\n

MITIGATION STEPS:<\/h2>\n

As a means to protect themselves the FBI has issued the following mitigation.<\/p>\n