Cook Medical Says Social Engineering Scam Gave Outsider Access to Company Systems

Cook Medical has disclosed that an employee was deceived by a social engineering attack on July 2 and inadvertently gave an outside party access to certain company systems, the Bloomington, Indiana-based device maker said in a statement in its online newsroom dated August 12.

The company said it identified the unauthorized access and contained it the same day. "Our information security infrastructure, reporting, and response teams were swift and worked exactly as they should," the statement said.

What was involved

According to Cook, an investigation carried out with an outside cybersecurity firm found that the information involved was primarily business contact information for US and Canadian customers, records of communications with Cook employees in its Salesforce system, employee names and company email addresses, and certain internal business files accessed through SharePoint.

"Based on our review to date, we have no evidence that sensitive or protected data was accessed," the company said. It said it was notifying customers and employees and giving them guidance on how to watch for follow-on scams, which it called "the most likely real-world risk from this type of incident."

Cook said the incident had not affected its products, its manufacturing or its ability to serve patients and customers, and that operations were running normally. The company said it would continue to update customers and employees as its investigation progresses.

A run of medtech incidents

Cook is the latest in a series of device makers to report cybersecurity incidents this year. Over the past several months, iRhythm, Stryker, Abbott, AdaptHealth, Medtronic and Intuitive have dealt with different threats, MedTech Dive reported on August 13. In Stryker's case, MedTech Dive said, the attack caused a global network disruption that affected its electronic ordering systems and caused shipping delays.

Cook's own statement framed the incident in the same context. "Cybercriminals have increasingly targeted organizations across the healthcare sector," the company said, adding that it was affected "along with other leading medical device companies."

The company, which is privately held, makes products used in vascular treatments, critical care, surgery and urology, according to MedTech Dive. Its divisions listed on its website include aortic intervention, interventional radiology, peripheral intervention, endoscopy, urology and critical care.

Cook did not say in its statement how many customers or employees were being notified, or name the outside party involved. It described the cause as social engineering, a category of attack in which a person is tricked into granting access, rather than a technical breach of its systems.