With the distribution of a COVID-19 vaccine already underway, the vaccine distribution chain is facing growing cyber risks...
With the distribution of a COVID-19 vaccine already underway, the vaccine distribution chain is facing growing cyber risks. Hackers have already targeted the European Medicines Agency (EMA), which is akin to the U.S. Food and Drug Administration (FDA). According to Pfizer and BioNTech, documents related to its COVID-19 vaccine were “unlawfully accessed” in the EMA attack.
In light of the increasing vaccine-related cyber threats, the IBM Security X-Force threat intelligence task force, the Federal Bureau of Investigation (FBI) and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) have all sounded the alarm.
Phishing Campaign Targeting Vaccine Distribution
In its report, IBM details a global phishing campaign targeting organizations associated with the COVID-19 cold chain, which is a component of the vaccine supply chain that ensures the safe preservation of vaccines in temperature-controlled environments during their storage and transportation. According to IBM, the perpetrators are impersonating a Chinese biomedical company called “Haier Biomedical” and sending phishing and spearphishing emails to executives and global organizations involved in vaccine storage and transport. As the report explains, “the established role that Haier Biomedical currently plays in vaccine transport, and their likely role in COVID-19 vaccine distribution, increases the probability the intended targets may engage with the inbound emails without questioning the sender’s authenticity.”
The phishing emails are posed as requests for quotations (RFQ) and contain malicious HTML attachments that open locally, prompting recipients to enter their credentials to view the file. IBM believes that the goal of the phishing campaign is to harvest credentials to gain future unauthorized access. “From there, the adversary could gain insight into internal communications, as well as the process, methods and plans to distribute a COVID-19 vaccine. This includes information regarding infrastructure that governments intend to use to distribute a vaccine to the vendors that will be supplying it,” the report states.
Next Steps for Impacted Entities
In its Cyber Alert, CISA encouraged Operation Warp Speed (OWS) organizations and organizations involved in vaccine storage and transport to review the IBM X-Force report. Meanwhile, IBM recommends that organizations take the following steps to increase their cyber readiness:
Be proactive. Create and test incident response plans to strengthen your organization’s preparedness and readiness to respond in the event of an attack.
Share and ingest threat intelligence. Threat-sharing initiatives and partnerships are essential to staying alert about the latest threats and attack tactics impacting your industry.
Assess your third-party ecosystem. Entities should assess potential risks introduced by third-party partners and robust monitoring, access controls and security standards are in place that third-party partners need to abide by.
Apply a zero-trust approach to your security strategy. As environments continue to expand, managing privilege access becomes paramount to ensuring that users are only granted access to the data that is essential to their job.
Use Multifactor Authentication (MFA) across your organization. MFA works as a fail-safe if a malicious actor has gained access to your credentials. As a last line of defense, MFA offers a second form of verification requirement in order to access an account.
Prioritize employee training. Conduct regular email security educational training so employees remain on alert about phishing tactics and are familiar with email security best practices.
Use Endpoint Protection and Response tools. These tools can help organizations to more readily detect and prevent threats from spreading across the organization.
Key Takeaway
The global COVID-19 pandemic has created a wealth of opportunities for cyber criminals. We encourage all businesses, particularly those involved in COVID-19 vaccine development and distribution, to thoroughly review and test their existing cyber policies and procedures to identify any potential weaknesses. For compliance assistance, we recommend consulting with an experienced attorney.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Does Your Homeowners Insurance Provide Adequate Coverage?
Your home is likely your greatest asset, which is why it is so important to adequately protect it. Homeowners insurance protects you from the financial costs of unforeseen losses, such as theft, fire, and natural disasters, by helping you rebuild and replace possessions that were lost While the definition of “adequate” coverage depends upon a […]
Understanding the Importance of a Non-Contingent Offer
Making a non-contingent offer can dramatically increase your chances of securing a real estate transaction, particularly in competitive markets like New York City. However, buyers should understand that waiving contingencies, including those related to financing, or appraisals, also comes with significant risks. Determining your best strategy requires careful analysis of the property, the market, and […]
Fred D. Zemel Appointed Chair of Strategic Planning at Scarinci & Hollenbeck, LLC
Business Transactional Attorney Zemel to Spearhead Strategic Initiatives for Continued Growth and Innovation Little Falls, NJ – February 21, 2025 – Scarinci & Hollenbeck, LLC is pleased to announce that Partner Fred D. Zemel has been named Chair of the firm’s Strategic Planning Committee. In this role, Mr. Zemel will lead the committee in identifying, […]
Novation Agreement Process: Step-by-Step Guide for Businesses
Big changes sometimes occur during the life cycle of a contract. Cancelling a contract outright can be bad for your reputation and your bottom line. Businesses need to know how to best address a change in circumstances, while also protecting their legal rights. One option is to transfer the “benefits and the burdens” of a […]
What Is a Trade Secret? Key Elements and Legal Protections Explained
What is a trade secret and why you you protect them? Technology has made trade secret theft even easier and more prevalent. In fact, businesses lose billions of dollars every year due to trade secret theft committed by employees, competitors, and even foreign governments. But what is a trade secret? And how do you protect […]
What Is Title Insurance? Safeguarding Against Title Defects
If you are considering the purchase of a property, you may wonder — what is title insurance, do I need it, and why do I need it? Even seasoned property owners may question if the added expense and extra paperwork is really necessary, especially considering that people and entities insured by title insurance make fewer […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Cyberattacks Aimed COVID-19 Vaccine Distribution Chain
Author: Scarinci Hollenbeck, LLC
With the distribution of a COVID-19 vaccine already underway, the vaccine distribution chain is facing growing cyber risks...
With the distribution of a COVID-19 vaccine already underway, the vaccine distribution chain is facing growing cyber risks. Hackers have already targeted the European Medicines Agency (EMA), which is akin to the U.S. Food and Drug Administration (FDA). According to Pfizer and BioNTech, documents related to its COVID-19 vaccine were “unlawfully accessed” in the EMA attack.
In light of the increasing vaccine-related cyber threats, the IBM Security X-Force threat intelligence task force, the Federal Bureau of Investigation (FBI) and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) have all sounded the alarm.
Phishing Campaign Targeting Vaccine Distribution
In its report, IBM details a global phishing campaign targeting organizations associated with the COVID-19 cold chain, which is a component of the vaccine supply chain that ensures the safe preservation of vaccines in temperature-controlled environments during their storage and transportation. According to IBM, the perpetrators are impersonating a Chinese biomedical company called “Haier Biomedical” and sending phishing and spearphishing emails to executives and global organizations involved in vaccine storage and transport. As the report explains, “the established role that Haier Biomedical currently plays in vaccine transport, and their likely role in COVID-19 vaccine distribution, increases the probability the intended targets may engage with the inbound emails without questioning the sender’s authenticity.”
The phishing emails are posed as requests for quotations (RFQ) and contain malicious HTML attachments that open locally, prompting recipients to enter their credentials to view the file. IBM believes that the goal of the phishing campaign is to harvest credentials to gain future unauthorized access. “From there, the adversary could gain insight into internal communications, as well as the process, methods and plans to distribute a COVID-19 vaccine. This includes information regarding infrastructure that governments intend to use to distribute a vaccine to the vendors that will be supplying it,” the report states.
Next Steps for Impacted Entities
In its Cyber Alert, CISA encouraged Operation Warp Speed (OWS) organizations and organizations involved in vaccine storage and transport to review the IBM X-Force report. Meanwhile, IBM recommends that organizations take the following steps to increase their cyber readiness:
Be proactive. Create and test incident response plans to strengthen your organization’s preparedness and readiness to respond in the event of an attack.
Share and ingest threat intelligence. Threat-sharing initiatives and partnerships are essential to staying alert about the latest threats and attack tactics impacting your industry.
Assess your third-party ecosystem. Entities should assess potential risks introduced by third-party partners and robust monitoring, access controls and security standards are in place that third-party partners need to abide by.
Apply a zero-trust approach to your security strategy. As environments continue to expand, managing privilege access becomes paramount to ensuring that users are only granted access to the data that is essential to their job.
Use Multifactor Authentication (MFA) across your organization. MFA works as a fail-safe if a malicious actor has gained access to your credentials. As a last line of defense, MFA offers a second form of verification requirement in order to access an account.
Prioritize employee training. Conduct regular email security educational training so employees remain on alert about phishing tactics and are familiar with email security best practices.
Use Endpoint Protection and Response tools. These tools can help organizations to more readily detect and prevent threats from spreading across the organization.
Key Takeaway
The global COVID-19 pandemic has created a wealth of opportunities for cyber criminals. We encourage all businesses, particularly those involved in COVID-19 vaccine development and distribution, to thoroughly review and test their existing cyber policies and procedures to identify any potential weaknesses. For compliance assistance, we recommend consulting with an experienced attorney.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
