The UK’s health and social care regulator, the Care Quality Commission (CQC), has faced an average of nearly 20,000 malicious email attacks a month in the past three months, according to official figures.
Obtained via a Freedom of Information (FOI) act request from the Parliament Street think tank, the data revealed that the commission, which regulates NHS services, was targeted by close to 60,000 malicious email attacks from December 2020 to February 2021.
The month in which the highest amount of attacks was recorded was January, at 20,486. This was followed by February, at 18,501 recorded cases, and December, at 17,587 cases.
The most common type of malicious email attack was phishing, making up 94% (52,905) of all recorded attacks in the three months. There were also 2311 malware instances and 1358 spam cases recorded by CQC in this period.
The figures have emerged in the context of the rapid rollout of COVID-19 vaccines across the world, which has been increasingly targeted by cyber-criminals in recent months. Last month, experts highlighted a new COVID-19 vaccine phishing scam in which NHS-branded emails were being used to trick users into handing over their personal and financial details. Additionally, recent data from NHS Digital showed that NHS staffers were hit by 137,476 malicious emails last year.
Commenting on the figures, Chris Ross, SVP sales international, Barracuda Networks, said: “Over the last 12 months, cyber-criminals have increasingly exploited the COVID-19 pandemic by using carefully tailored phishing emails to trick remote employees into handing over confidential data and personal information. Our recent research even revealed a 26% spike in vaccine related phishing activity since October 2020.
“Due to its association with the NHS and the vaccination program, scammers have clearly identified the CQC as a hot target for valuable data and will continue to send malicious email attacks to employees until sensitive information or login credentials are leaked – once compromised, data can then be sold on the black market, or used to hold the organization to ransom.”