Alberta Health Service’s EMS, and UCP leadership candidate Leela Aheer were among the high profile Facebook pages to have been hacked this week.
And while neither AHS or Aheer have been able to yet comment on what caused the breaches, a cyber security expert reminds Calgarians to be wary of online threats.
Jeannie Adams, CEO of Calgary-based S01ve Cyber Solutions, said that it was likely that the Facebook accounts were hacked due to the high profile nature of both.
“You’ve got access to people, and you’ve got that publicity that a regular person doesn’t have,” said Adams about the accounts.
She said that makes high-profile accounts more attractive to hackers and criminals attempting to do damage, or to gain access to personal or financial information.
“Ultimately what they’re trying to do is get access to either to scare people, or they’re looking for information about people to then use to either to sell, or to use it to get into more accounts.”
RELATED: Calgary Police warning of new extortion scam
Adams said this even applies to individuals with less well used, less high-profile accounts than AHS and Aheer.
“They’re going and pretending to be you, or they’re pretending to be your business, And then they’re doing things to either get account information or private information,” she said.
“So things like credit cards, social insurance numbers, or even just names, so that they can then start to pretend to be someone else, or sell that information to someone who can pretend to be someone else and they can extort from people or embarrass them.”
No patient information compromised in AHS Facebook hack
Alberta Health Services released a statement on Twitter on Tuesday as the hack was occurring, stating that they were aware of the issue and were working with Facebook to shut down the account.
As of the afternoon of Wednesday, August 24, Facebook had yet to deactivate the page or remove the DOTA2 video.
“We are actively working with Facebook to assist in shutting down the page as a short term solution,” an AHS emailed statement read.
AHS said that the Facebook page was only used to provide public education and EMS related information, and that no patient information was breached in the attack.
“AHS does not use Facebook or any social media platform to share or store patient information,” they said.
LiveWire Calgary asked AHS if the account had been used to send messages to other Facebook users impersonating AHS EMS. A spokesperson for the health service said they were not aware if any messages had been sent or not.
AHS said public updates would come through their media account on Twitter at @AHS_media.
Aheer believes hack was politically motivated
Aheer, during a press conference with the media held on Wednesday morning, said that she believed the hacking of her Facebook pages was a targeted political attack against her.
Aheer, was visibly shaken by the breaches during the press conference, and said that she had spent the previous day with Strathmore RCMP’s victim services. The individual or individual who had breached the accounts shared posts that went against Facebook’s standards on child nudity and sexual exploitation.
“Over the past few weeks I have outlined my principles, and the fact that I will never tolerate bigotry in a government that I lead, and I believe that these attacks on my account was driven by people who want to silence my voice and derail our campaign,” she said.
“This was targeted.”
Investigation into the breaches of her campaign page, and her personal page have been opened with the RCMP.
“The RCMP are involved because it’s criminal, and yes I hope they catch the person,” said Aheer.
She denounced the vileness of the attack made against her personally and against her campaign, and said that now was a time for Albertans to make a stand—irrespective of politics.
“This is a collective responsibility for all of us to stand on, strongly, and not allow this to not only infiltrate our politics, but the people who are in the public, or female journalists, or anyone else,” Aheer said.
“This is us making a stand on principles that I have made well known, and ones that I intend to never back down on. Ever.”
Danger to the public is real, and trust your gut
Adams said that whenever anyone has a digital exchange, even when with trusted individuals, that people should be aware of warning signs that something might be off.
“If someone’s asking a question or asking or acting in a way that does not feel right, you need to question that,” she said.
“People need to come from a point of understanding, in that they do have the ability to deal with these things. If somebody’s sending you an email, and it’s a trusted person or a trusted business, you got to make sure that that information is correct.”
An example she used with was with a client who had emails sent from what appeared to be members of the senior leadership team asking for money to be sent and financial account access changed.
“That person actually had an understanding that that felt weird, and they shouldn’t be changing an account like that. But because it was coming from leadership, they felt OK, well, they obviously know better,” Adams said.
“In fact, it was that they had been hacked. A client that they had a digital exchange with had been hacked, and so they were at risk.”
Creating the right environment can head off cyber attacks
In that particular case they were able to get the funds back. But Adams said that one of the most important things her firm does when working with clients is to create an atmosphere where people can admit mistakes.
“You’ve got to create this environment where people can say, ‘wait a second,'” she said.
Adams said that often hackers will breach a system and then sit on that breach for months at a time. She said that in an environment where people can go to their IT departments openly if they think something might not be right, that vulnerability can be often caught before it becomes an issue.
She said many clients have made cyber security a gain – not something punitive.
“That’s actually changed everything, because if you get somebody who’s distracted for a moment, and they click on a file, and then at some point feel like it might not have been right, they feel empowered to go to their IT group and say ‘I think I did something wrong,'” Adams said.
“In a punitive environment, that employee is going to ignore that and they’re gonna hope nobody sees anything.”
Red flags to watch out for during phishing and cyber attacks
The Canadian Centre for Cyber Security, as part of Canada’s Communications Security Establishment, has multiple suggestions on how to secure online accounts of all types:
- Use unique and complex passwords for each account or device
- Enable multi-factor authentication when offered by a service
- Review your privacy settings often, ensuring that you don’t share more information with strangers than you would like
- Don’t share personal revealing information, like home phone numbers, personal email addresses, home addresses, or geotagged photos
- Don’t share banking or financial institution information like bank, credit, or debit card numbers
- Be aware of threatening messages that purport violence or legal action to take immediate action to share personal or financial information
- Look out for information mismatches, such as similar but incorrect email or website addresses
- Look out for links that direct you to login pages, or requests to update your account information
- Watch out for suspicious attachments and uncommon file types
- Look for obvious spelling and grammar mistakes that a legitimate organization wouldn’t miss
