FBI Warns of Cyber Attacks on Patient Health Data
The FBI’s Cyber Division has issued an alert to health care professionals warning of cyber attacks targeting File Transfer Protocol (FTP) servers to access protected health information and personally identifiable information. Such data, the FBI cautions, can be used for criminal purposes — including blackmail, identify theft or financial fraud. The alert notes that more than 1 million FTP servers are configured to allow anonymous access, potentially exposing sensitive records.
According to the FBI, the anonymous extension of FTP allows users to authenticate to the server with a common username such as “anonymous” — and without submitting a password. Cyber attackers can also gain access by submitting a generic password or e-mail address. “Cyber criminals could use an FTP server in anonymous mode and configured to allow ‘write’ access to store malicious tools or launch targeted cyber attacks,” the alert states.
Oral health and medical providers are encouraged to check their networks for FTP servers running in anonymous mode. In addition, practices operating an FTP server in anonymous mode should ensure that protected health information and personally identifiable information is not stored on the server.
The FBI asks health care professionals to report information concerning suspicious or criminal activity to their local FBI field office (fbi.gov/contact-us/field) or the bureau’s 24/7 Cyber Watch (855-292-3937; mailto:CyWatch@ic.fbi.gov).
