Credential stuffing attacks are a risk to healthcare organizations because they can lead to unauthorized access through their email. This access opens the way to unauthorized access to sensitive patient information.
Credential stuffing is a type of cyber attack where hackers use stolen username and password pairs to gain unauthorized access to user accounts. They obtain these credentials from data breaches on other websites and then use automated tools to rapidly try them on various online services.
A case study of the Canva credential stuffing attack provided a comprehensive definition, “Credential cracking, also known as brute force attack, is an attack using automated tools to test different values of usernames and passwords in order to find valid credential sets. This method usually utilizes common or simple password phrases, so it is supposed to be useful against users with simple and easily guessable passwords.”
Since many people reuse passwords across different sites, these attacks often succeed. The attackers can then exploit the compromised accounts for identity theft, financial fraud, or selling access to other criminals. This method is highly effective because it takes advantage of weak password practices and requires minimal effort once the credentials are obtained.
In a credential stuffing attack, hackers use stolen username and password pairs, often obtained from data breaches on other websites, to gain unauthorized access to user accounts on different platforms. Unlike brute force attacks, which involve guessing passwords by systematically trying numerous combinations, credential stuffing relies on actual credentials that users have previously used and that are now compromised. This method is particularly effective because it exploits the common habit of reusing passwords across multiple sites, allowing attackers to bypass the need for guessing or cracking passwords.
In contrast, phishing attacks deceive users into voluntarily providing their login information by masquerading as legitimate entities. Malware-based attacks involve installing malicious software on a victim's device to capture credentials as they are entered. Credential stuffing is more straightforward and often more successful than these methods because it directly uses already compromised data, allowing attackers to rapidly and efficiently test large volumes of credential pairs across various services.
See also: Cyberattacks on the healthcare sector
Credential stuffing can impact even HIPAA compliant email systems by compromising the security of user accounts through the use of stolen credentials. When hackers gain access to email accounts using these credentials, they effectively bypass the stringent security measures designed to protect sensitive health information. This unauthorized access allows them to intercept, read, or manipulate emails containing protected health information (PHI).
The Counterterrorism Group reported that Kaiser Permanente, a major healthcare organization, experienced a data breach that exposed the sensitive information of approximately 13.4 million patients and members. This breach involved third-party code trackers leaking IP addresses, names, and user interaction data from the company's website and mobile applications. Although the breach did not include social security numbers or financial information, the compromised data posed risks.
Following the breach, cybersecurity experts warned of a potential increase in credential stuffing attacks. Credential stuffing involves using stolen credentials from previous breaches to gain unauthorized access to user accounts on various platforms. In this case, the leaked data could enable cybercriminals to launch large-scale attacks on healthcare infrastructure by using the exposed information to identify and exploit weak points in login systems.
MFA is a security process that requires users to provide two or more verification factors to gain access to an account.
Through data breaches on other websites, phishing attacks, or purchasing them from dark web marketplaces.
Use multi-factor authentication (MFA), monitor for unusual login activities, and conduct regular security assessments.