Cyber-Attacks and Fraud from Workers’ Compensation Data

Cyber-attacks are a growing threat for the workers’ compensation industry. The potential for blackmail in workers’ comp is ripe for attacks due to sensitive information held about individuals. Third party administrators, hospitals, corporations, law firms, and compensation insurers may all hold this type of information, which if gained access to, can lead to identity theft.1

Examples of Stolen Information

• Social security numbers
• Sensitive information about an injured worker’s status
• Worker is HIV positive
• Embarrassing circumstances about an accident
• Chronic disease
• Unannounced pregnancy2

Online Shift Creates More Vulnerabilities

The fact that workers’ compensation processes have shifted online during the pandemic has made more information accessible on the worldwide web.3 Remember when information was traditionally stored in paper files inside drawers and cabinets? This made it difficult for information to be stolen unless an outside individual gained physical access into a building, or information was stolen by someone privy to that information, such as an employee. Now, through technology, procedures involving “legal disputes, benefits applications, communications and medical treatments” all functioning in a virtual environment has created more vulnerabilities, which can be exploited from occasional updates to software or operating systems.45 Many of the changes made during the transition to online and remote work are here to stay, as people view them favorably. One example is telemedicine, where healthcare details of patients are shared and can go into workers’ compensation suits.

Biometrics

As patients’ and injured workers’ personal information is being stored on the internet, so are their biometric data. Biometric information may include sensitive information about one’s DNA or physical characteristics, such as fingerprints, gait (walking style), eye characteristics, vein recognition, voice recognition, and digital signatures.6 Biometrics can “identify a person for their entire lifetime.”7 As such, privacy concerns are abound when others gain access to this information. Often biometrics are used to unlock devices such as smartphones or gain “entry into offices and secure areas.”8 Hackers may use this to infiltrate organizations. On the dark web, personal health information “tends to be among the more expensive data files sold”, all which hackers can use to commit fraud.9

Types of Fraud That Can Be Facilitated Through Access of Sensitive Information

• SSN Fraud
• Healthcare Fraud – using someone else’s insurance information for personal gain.
• Tax Identity Theft – filing a tax return in another person’s name to obtain a refund.
• Biometric ID Theft
• Synthetic Identity Theft – where people create fictitious identities using your personal information.
• Medical Identity Theft – posing as another person to receive medical services.1011

Examples of Cyber-Attacks

There is a growing urgency for companies to be able to respond and protect themselves from cyber-attacks, which can include:

• Social Engineering Scams – phishing or baiting scams through email and online downloads.
• Malware, or ransomware – installing harmful software on a computer after clicking on a link or email attachment.
• Botnets – spread spam and deliver viruses.
• Denial-Of-Service (DDOS) – overwhelming a system’s resources causing a site to go offline.
• SQL Injections and Other Web Application Attacks – inserting malicious code, allowing otherwise private information to be divulged, such as “customer details, user lists, and confidential company data.”12

Cyber Liability Insurance

Cyber liability insurance, which can provide expert resources and financial support, is becoming more of a go-to for companies. Organizations that use it can provide peace of mind to their clients to protect against threats. Other organizations that want to do business through contracts may even seek or favor companies that have cyber liability insurance.13 Protecting personal information of clients is a top priority for the business landscape as cybercrime evolves and becomes more prevalent.