Data breaches are becoming an alarming trend, and health care incidents stand out for their potentially lifelong consequences. I just reported how a data breach at a physician-led vein center exposed almost half a million people’s data to hackers. And now, another health care data breach has come to light and this one affects even more people. The data breach exposes sensitive personal and medical information belonging to over 910,000 patients through ConnectOnCall, a telehealth platform and after-hours call service owned by Phreesia.

GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE

What you need to know

Health care software provider Phreesia has revealed that its ConnectOnCall service was hit by a data breach that lasted from Feb. 16 to May 12, 2024. During this time, an unknown hacker gained access to the platform and pulled data from provider-patient communications. ConnectOnCall helps health care providers handle after-hours communication and automate patient call tracking.

Phreesia, which bought ConnectOnCall in October 2023, discovered the breach on May 12 and says it jumped into action right away. The company brought in external cybersecurity pros to lock down the platform and reported the breach to federal law enforcement.

“On May 12, 2024, ConnectOnCall learned of an issue impacting ConnectOnCall and immediately began an investigation and took steps to secure the product and ensure the overall security of its environment,” the company revealed in a press release.

According to a report filed with the U.S. Department of Health and Human Services, the breach impacted 914,138 patients (via Bleeping Computer). The stolen data includes names, phone numbers, medical record numbers, dates of birth and details about health conditions, treatments or prescriptions. In a few cases, Social Security numbers were also compromised.

Phreesia claims its other services, like the patient intake platform, were not affected. The company has since taken ConnectOnCall offline and is working on bringing it back in a more secure setup.

We reached out to ConnectOnCall for a comment but did not hear back by our deadline.

Emergency room sign (Kurt “CyberGuy” Knutsson)

UNDERSTANDING BRUSHING SCAMS AND HOW TO PROTECT YOURSELF

The risks associated with the ConnectOnCall data breach

The impact of this breach is significant due to the sensitive nature of health care data. Unlike financial breaches, where compromised accounts can be frozen or replaced, health information is permanent and highly sought after on the dark web. Cybercriminals may exploit this data to commit identity theft, including obtaining prescription drugs fraudulently or filing false insurance claims.

Plus, the detailed health information exposed – such as diagnoses, treatments and medications – can be used for targeted phishing attacks. Scammers could exploit victims’ medical histories to create highly convincing schemes, increasing the likelihood of success.

Phreesia has mailed notification letters to all affected individuals for whom health care providers had valid mailing addresses as of Dec. 11, 2024. For those whose Social Security numbers were exposed, the company is offering identity and credit monitoring services.

A doctor writing notes (Kurt “CyberGuy” Knutsson)

CYBER SCAMMERS USE AI TO MANIPULATE GOOGLE SEARCH RESULTS

7 ways to keep yourself safe from such data breaches

1) Regularly monitor your financial and medical accounts: Periodically review your medical records and health insurance statements for any unusual or unauthorized activity. This can help you quickly identify and address any discrepancies or fraudulent activities.

Use patient portals provided by health care providers to access your medical records online. These portals often have features that allow you to track your medical history and appointments. 

2) Use strong passwords and two-factor authentication (2FA): Create strong, unique passwords for your online accounts, including health care portals. Avoid using easily guessable information like birthdays or common words. Consider using a password manager to generate and store complex passwords.

3) Enable two-factor authentication wherever possible: 2FA adds an extra layer of security by requiring a second form of verification, such as a text message code or authentication app, in addition to your password.

4) Don’t fall for phishing scams; use strong antivirus software: Be mindful of the information you share online and with whom you share it. Avoid providing sensitive personal information, such as Social Security numbers or medical details, unless absolutely necessary. Verify the legitimacy of any requests for personal information. Scammers often pose as health care providers or insurance companies to trick you into revealing sensitive data by asking you to click on links in emails or messages.  

The best way to safeguard yourself from malicious links is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

5) Use identity theft protection services: Consider enrolling in identity theft protection services that monitor your personal information and alert you to potential threats. These services can help you detect and respond to identity theft more quickly. Some identity theft protection services also offer insurance and assistance with recovering from identity theft, providing additional peace of mind. See my tips and best picks on how to protect yourself from identity theft.

6) Freeze your credit: A credit freeze prevents anyone from opening new credit accounts in your name without your authorization, reducing the risk of identity theft. Contact the major credit bureaus (Experian, Equifax and TransUnion) to request a credit freeze. This is often free and can be temporarily lifted when you need to apply for credit.

 7) Remove your personal data from the internet: After being part of a data breach, it’s crucial to minimize your online presence to reduce the risk of future scams. Consider using a personal data removal service that can help you delete your information from various websites and data brokers. This can greatly diminish the chances of your data being used maliciously. Check out my top picks for data removal services here.

DON’T LET SNOOPS NEARBY LISTEN TO YOUR VOICEMAIL WITH THIS QUICK TIP

Kurt’s key takeaway

The ConnectOnCall health data breach highlights the critical need for robust cybersecurity measures within the health care sector, where the stakes are often much higher than in other industries. With over 910,000 patients affected, this incident shows the serious risks posed by cyberattacks on health care platforms. Sensitive data like medical records and Social Security numbers are permanent and can be misused for identity theft and fraud. If you were impacted, stay vigilant by monitoring your accounts, enabling fraud alerts and considering identity theft protection services. 

Do you think health care providers should face stricter regulations for protecting sensitive patient information? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most asked CyberGuy questions:

X has substantially raised the price of its top-tier user subscription in multiple regions to help bolster the platform’s creator payouts. The increase for Premium Plus came into effect on December 21st according to X, raising prices in the US from $16 per month to $22, or from $168 to $229 for annual subscriptions.

Many European countries like France, Germany, and Spain are impacted by a similar increase, taking monthly prices from €16 to €21. Monthly subscribers in Canada (currently paying $20), Australia ($26) and the UK (£16) will also see pricing increased to $26, $35, and £17 respectively. The higher pricing is immediately applicable to new subscribers, with existing users grandfathered into their current rates until January 20th. X’s basic subscription tier remains unaffected.

The pricing changes for US subscribers are the highest increase introduced since Elon Musk purchased the social media platform in 2022. X gave several reasons to justify the price hike, citing that Premium Plus is now completely ad-free — which it described as a “significant enhancement” to the current user experience.

X also references changes made to the X revenue sharing program in October, saying that subscriptions “now more directly fuels” creator payouts to “reward content quality and engagement rather than ad views alone.” Premium Plus subscribers will additionally receive priority user support, access to additional features like X’s Radar trend monitoring tool, and higher limits on the platform’s Grok AI models.

Imagine receiving a call that would change your life forever, one filled with urgency, authority and deception so convincing that even the most cautious could fall prey. Barb G’s story is one that no family should ever have to endure. She emailed us saying that her elderly mother, a former bookkeeper and a sharp, independent woman, fell victim to an elaborate scam that drained her life savings and exploited her trust.

“My 82-year-old mother was not only scammed out of her entire life savings, but after they drained her accounts, they then pretended to be the FBI. They told her she had been scammed, and they needed to ‘protect’ her. They said they would be sending a car to pick her up in 20 minutes.”

The emotional toll of such elder fraud scams is immeasurable, leaving victims and their families grappling with feelings of betrayal, fear and helplessness. Here’s how this particular scam unfolded and what you can do to protect yourself.

GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE

How the scam played out

This was no ordinary scam. It involved manipulation, intimidation and psychological tactics so sophisticated that her mother was driven three and a half hours to a Bitcoin machine and coerced into maxing out her credit cards. As Barb further recounted, “After that, they dropped her at a hotel…told her not to call anyone or go out of the hotel for three days. They had someone watching the hotel to ‘protect’ her.”

Even after her family rescued her, the scammers struck again. This time, they convinced her to hand over another $20,000, preying on the faint hope that she might still receive the promised $1 million. Barb’s words echo a sentiment many families share:

“Even when someone KNOWS they have been scammed, there’s still a part of them that thinks the whole thing just might be real.”

A woman on her cellphone (Kurt “CyberGuy” Knutsson)

UNDERSTANDING BRUSHING SCAMS AND HOW TO PROTECT YOURSELF

The growing threat of elder scams

Stories like Barb’s are becoming alarmingly common. Scammers target older adults for several reasons: They often have accumulated savings, they may be less familiar with modern technology, and they are more likely to trust strangers. According to the Federal Trade Commission, seniors lose billions of dollars annually to fraud. The psychological toll is equally devastating, leaving victims ashamed, isolated and fearful.

A woman navigating her cellphone (Kurt “CyberGuy” Knutsson)

SNEAKY SCAMMERS DRAIN BANK ACCOUNT IN SINISTER PHONE PHISHING SCHEME

Common tactics scammers use

Scammers employ a variety of deceptive strategies to exploit unsuspecting victims. Here are some of the most common tactics they use:

• Impersonation scams: Posing as government officials, law enforcement or family members
• Prize and lottery scams: Convincing victims they won a prize that requires upfront payment
• Tech support scams: Offering fake tech help to gain remote access to devices
• Romance scams: Building trust over time to exploit emotional vulnerability
• Emergency scams: Pretending a loved one is in danger and needs immediate financial help

Illustration of a tech scam (Kurt “CyberGuy” Knutsson)

YOUR EMAIL DIDN’T EXPIRE, IT’S JUST ANOTHER SNEAKY SCAM

Tips to protect yourself and your loved ones

Recognizing the red flags is essential to avoid falling victim to scams. Here are some important red flags to be aware of.

Unsolicited calls or emails: Be wary of anyone asking for personal or financial information. Legitimate organizations will not ask for sensitive information in this manner.

Urgent requests for payment: Scammers often demand immediate action to avoid scrutiny. Take a moment to verify the request through official channels before responding.

Unfamiliar contact information: Be cautious if the contact information provided does not match the official contact details of the company or organization.

Untraceable payment methods: Requests for payment via gift cards, cryptocurrency or wire transfers are major warning signs. Reputable companies will not ask for these types of payments.

Too-good-to-be-true offers: If an offer seems too good to be true, it likely is. Research and verify any claims before proceeding.

Illustration of a tech scam (Kurt “CyberGuy” Knutsson)

8 ways to protect yourself from being scammed

Protecting yourself and your loved ones from scams requires vigilance and awareness. Here are eight effective ways to safeguard against scammers:

1) Verify before you act: Always verify the identity of the person or organization contacting you. Use official contact information to reach out directly and confirm the legitimacy of the request.

2) Limit personal information sharing: Avoid sharing personal or financial information over the phone, email or online unless you are certain of the recipient’s identity and legitimacy.

3) Invest in personal data removal services: Consider using a service that specializes in removing your personal information from the internet to reduce your exposure to potential scammers. Check out my top picks for data removal services here.

4) Monitor financial accounts: Regularly check your bank and credit card statements for any unusual or unauthorized transactions. Promptly report any suspicious activity.

5) Enable security features: Use strong, unique passwords for all your accounts and consider using a password manager to generate and store complex passwords. Also, enable two-factor authentication for an extra layer of security.

6) Be skeptical of unsolicited requests: Treat unexpected requests for money or personal information with caution. Scammers often create a sense of urgency to pressure you into acting quickly.

7) Use strong antivirus software: Ensure your devices are protected with strong antivirus software that can detect and block malicious activities. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

8) Report suspected scams: If you suspect you’ve encountered a scam, report it to your local authorities, the Federal Trade Commission and any relevant financial institutions.

SUBSCRIBE TO KURT’S YOUTUBE CHANNEL FOR QUICK VIDEO TIPS ON HOW TO WORK ALL OF YOUR TECH DEVICES

Kurt’s key takeaways

Scams are getting sneakier, but you’re smarter. Trust your gut and remember: If something feels off, it probably is. Don’t let the fear of scams isolate you or your loved ones. Instead, follow these tips so you can outsmart the scammers and keep your hard-earned money where it belongs: in your pockets. Remember, it’s not about paranoia; it’s about being prepared. So, next time you get that urgent call or too-good-to-be-true offer, take a deep breath and ask yourself: “What would Barb’s mom do differently now?”

Do you think the government, businesses or both should take greater responsibility in preventing elder scams and what specific actions should they take? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most asked CyberGuy questions: