HIPAA constrains content and requires encryption in transit and audit trails.
What business email compromise (BEC) is#
BEC is a targeted attack where an attacker impersonates an executive or vendor to redirect payments or extract data, often from a legitimate compromised mailbox rather than a spoofed one.
Why it matters#
BEC causes more financial loss than any other cybercrime category, and it frequently passes authentication because the mailbox is real.
Implementation plan for healthcare organizations#
- Require MFA on all mailboxes and disable legacy authentication protocols.
- Alert on new inbox rules that forward or delete mail, a common attacker persistence step.
- Verify payment changes by phone using a known number, never the one in the email.
- Flag external mail with display names matching internal staff.
Priorities specific to healthcare organizations#
HIPAA constrains content and requires encryption in transit and audit trails. Weight your effort toward the steps above that address this constraint first, and measure with metrics that match how healthcare organizations generate value from email.
Common mistakes#
- Assuming DMARC protects against BEC from a compromised real account.
- No out-of-band verification policy for finance.
Frequently asked questions#
How is BEC different from phishing?
Phishing casts wide for credentials; BEC is targeted social engineering for money, often using a real hijacked account.