Threat actors are drawn to healthcare emails due to the high value of sensitive information and the potential to create costly disruptions. This means that avenues such as mailbox delegation can become exploited means of receiving access to private information.
According to Microsoft, a delegated mailbox provides, “...the ability for others to create email messages or respond to meeting requests on your behalf. As the person granting permission, you determine the level of access that the delegate has to your folders.”
Mailbox delegation is a feature that allows an individual, known as a delegate, to access and manage another person's email account with specific permissions. The account owner grants these permissions to a trusted individual, enabling them to handle various email-related tasks efficiently.
Delegates can read emails, send messages on behalf of the account owner, delete unwanted emails, and manage other mailbox functions like calendar appointments. For instance, an executive assistant can be authorized to organize their manager's inbox by sorting through messages, replying to routine emails, and scheduling or updating calendar events.
Healthcare differs from other organizations in its functioning due to strict privacy regulations like HIPAA, which require careful handling of patient data. For instance, a nurse could be granted permission to manage a physician’s inbox to schedule appointments or share lab results with other departments. This access speeds up patient care, allowing doctors to focus on treatment rather than administration.
There are still downsides to consider, privacy being one of the main ones. Delegates need to be well-trained to prevent accidental exposure of sensitive patient information, and access control must also be carefully managed. Despite these challenges, mailbox delegation benefits healthcare organizations by reducing administrative burdens on medical staff and enabling smoother communication across teams.
According to an Acta Biomed study, the characteristics of an effective delegation strategy include, “...five rights for effective delegation which are described as follows; right task, right person, right time, right directions and communication, and right supervision and evaluation.”
These can further be explained as:
See also: How HIPAA compliant email improves the patient experience
See also: HIPAA Compliant Email: The Definitive Guide
Threat actors seek access to healthcare emails primarily to exploit the wealth of sensitive information contained within these communications for financial gain. A Heliyon journal article provided, “Most of today's threat actors still use phishing to exploit their victims. Threat actors continue to develop their tactics, methods, and procedures for the various phishing attacks to maximize the likelihood of successful exploitation.”
Healthcare emails often include personal data such as names, birth dates, Social Security numbers, and medical histories, along with billing and insurance details. Cybercriminals can use this data to commit insurance fraud, billing scams, and identity theft or sell it on the dark web to others seeking to profit from stolen information.
Beyond this, access to healthcare emails provides threat actors with valuable insights into the organization's internal operations. They can use these insights to craft targeted phishing attacks, deceive staff into divulging credentials, reveal system vulnerabilities, or approve unauthorized transactions. Once inside the email system, hackers can monitor ongoing conversations and adapt their tactics to be more convincing.
Threat actors can plant ransomware or other malware by infiltrating healthcare emails. Ransomware encrypts patient files and medical data, disrupting operations and forcing organizations to pay a ransom to regain access. Given the urgency of healthcare services, healthcare institutions often feel pressured to pay quickly.
Threat actors exploit mailbox delegation by gaining unauthorized control of the credentials of a delegate—an individual who already has access to another person's email account. They often do this through social engineering techniques, such as spear-phishing or by exploiting weak passwords. Once they obtain these credentials, they can assume the identity of the legitimate delegate and access the primary email account's contents.
With delegated access, threat actors can read and download sensitive emails, including personal information, financial data, or internal strategies. They also send emails as if they are trusted delegates, enabling them to manipulate conversations and send false instructions that other staff members might follow, believing them to be genuine. For example, they might request unauthorized fund transfers, manipulate billing information, or ask for sensitive data.
With control over delegated permissions, they can modify account settings to hide their presence, making it difficult to detect unauthorized access. This allows them to conduct prolonged attacks, such as creating phishing emails targeting other staff members or external partners.
Threat actors can also delete or alter emails to remove traces of their activity and sow confusion among the healthcare staff.
See also: Top 12 HIPAA compliant email services
Review delegated access permissions periodically, ideally every three to six months, to ensure permissions are up-to-date and relevant, and promptly revoke access for inactive delegates.
Enable encryption, enforce screen lock policies, and use mobile device management (MDM) to control and monitor access to delegated mailboxes.
They should avoid clicking on links or downloading attachments and report the email to the IT security team for further investigation.