Voice Phishing Is the New Front Door

What would you do if your phone rang and the caller ID showed your own company? Would you pick up? Would you help the person on the other end?

This Cybersecurity Awareness Month, Ron goes solo to break down a breach that started with that exact call. Attackers spoofed Astrana Health’s main corporate phone number, posed as coworkers, and talked their way into systems connected to roughly 1.5 million patients. Ron starts with a rewind from phone books to data brokers, including a live search on a people-search site that turned up his own family. From there he walks through the SEC filing, sends a swarm of AI research agents after the public record, and lines up the suspects behind the attack.

The uncomfortable part is that we spent a decade training people to spot a bad email while attackers moved to the phone. Voice phishing is now the second most common way attackers get in, and resetting credentials doesn’t fix the instinct to help when a familiar number calls. Ron closes with three practical ways to stop making it easy for them, starting with one simple habit: hang up and call back.

Impactful Moments

00:00 - Introduction 02:25 - The rewind: from phone books to data brokers 03:15 - What a people-search site found on Ron’s family 05:30 - A breach that started with a phone call 06:15 - Inside Astrana Health’s SEC filing 07:55 - Why spoofing the main number changes everything 09:05 - How the attack likely played out 11:35 - Technical fixes for a human attack 12:50 - The time Ron got got 13:35 - Why attackers want healthcare data 15:15 - 1.5 million patients’ worth of exposure 17:15 - Voice phishing climbs to #2 in M-Trends 19:35 - Three ways not to make it easy for them 21:05 - How to run a phone drill

Links

Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/