The Pharmacy Email Breach
A small independent pharmacy had its email account compromised and criminals used it to request fraudulent prescription payments from NHS contacts.
Attack Chain
- 1Phishing email captures owner's email password
- 2Inbox monitored silently for two weeks
- 3Fraudulent invoices sent to NHS contacts
- 4Supplier fraud also conducted via same access
Background
An independent pharmacy in a market town used a single shared email account for all communications — supplier orders, NHS correspondence, staff messages, and customer queries. The email account had no two-factor authentication and used a password set when the business was established five years earlier.
The Attack
The pharmacy's email password was obtained through a phishing email that the owner clicked while distracted. Criminals monitored incoming emails for two weeks, learning the pharmacy's suppliers, NHS contacts, and payment patterns. They then sent fraudulent invoices to NHS payment contacts requesting payment to a new bank account, impersonating the pharmacy.
Response
The NHS payment team noticed a change in bank details and called the pharmacy to verify, discovering the fraud before any NHS funds were transferred. However, the owner discovered the criminals had also used the email access to order £4,200 of medicines from a supplier, billed to the pharmacy.
Outcome
No NHS funds were lost due to the phone verification. The pharmacy faced a £4,200 supplier invoice for goods delivered to a fake address. The email account breach also exposed prescription data for several customers, requiring an ICO notification.
Key Takeaways
- Enable two-factor authentication on your business email account as a priority — it is the single most effective security measure for small businesses
- Never use a shared email account — individuals should have their own accounts so you can identify when one is compromised
- Suppliers and partners should call to verify any request to change bank details, however the request arrives
- A breach of your email account means criminals can read everything — change all linked account passwords immediately
- Patient or customer data breaches must be reported to the ICO within 72 hours — know this requirement before it happens