A growing wave of sophisticated phishing attacks is currently sweeping across the United States, targeting patients of major health systems by impersonating Epic’s widely used MyChart patient portal. As of this week, more than a dozen prominent healthcare organizations have issued urgent security warnings to their patient populations, advising extreme caution regarding unsolicited emails that leverage the trusted MyChart brand to harvest sensitive personal, medical, and financial data.
While the sheer scale of the campaign is alarming, cybersecurity experts and Epic officials have clarified that these attacks are not the result of a breach within Epic’s internal infrastructure. Instead, malicious actors are weaponizing the ubiquity and recognition of the MyChart brand to deceive patients through highly convincing, albeit fraudulent, digital touchpoints.
The Anatomy of the Deception: How the Scams Operate
The current phishing campaign is notable for its high degree of professional mimicry. Scammers are utilizing legitimate MyChart branding, including official logos and formatting, to create a veneer of institutional credibility.
Epic, the Wisconsin-based electronic health record (EHR) giant, has confirmed that the attackers are effectively "cloning" the visual architecture of their authentic login pages. By directing victims to lookalike domains—such as mychart-epic[.]com rather than the official portals hosted by individual health systems—the attackers capture credentials and sensitive information as soon as a user attempts to "log in."
Two Primary Attack Vectors
According to Epic’s internal documentation, the campaign currently relies on two distinct, high-pressure tactics:
- The "Critical Result" Ruse: This tactic involves an email notification alerting the patient to a "critical" lab result. By inducing a sense of urgency or fear, the attackers pressure the recipient to click a link to view their report, which subsequently prompts them to download malicious software or "update" their portal access credentials.
- The "Survey" and Reward Scam: This vector targets the desire for better healthcare benefits. Scammers offer fake incentives, such as a "MyChart Medicare Kit" or a "Senior Health Package." These emails direct users to a countdown-timer survey. Once the victim completes the survey, they are prompted to provide credit card or banking information to cover "shipping costs" for the non-existent health rewards.
Chronology of the Threat
The emergence of this campaign highlights the evolving nature of cybercrime in the post-pandemic digital health landscape.
- Early Detection: In recent months, reports began trickling into various health system IT help desks regarding "suspicious" portal notifications.
- Escalation: Within the last two weeks, the volume of these reports spiked, leading to coordinated security alerts from over a dozen health systems across multiple states.
- Epic’s Intervention: Epic responded by reinforcing its cybersecurity guidance, explicitly warning that they would never contact patients directly to request financial information or require the download of software to view lab results.
- Industry-Wide Alert: The campaign has now moved into a phase of heightened public awareness, with hospitals utilizing social media, email newsletters, and local news outlets to educate their patients on how to differentiate between legitimate institutional communication and fraudulent outreach.
Expert Perspectives: The Behavioral Challenge
The rise of these attacks has triggered a broader conversation among cybersecurity and behavioral science experts regarding the "trust gap" in digital healthcare.
Jackie Mattingly, Senior Director of Consulting Services at the cybersecurity firm Clearwater, emphasizes that the burden of defense cannot rest solely on the patient. "We should not expect patients to identify a scam simply because of bad grammar, an unusual logo, or an obviously suspicious message," Mattingly stated. "Phishing is becoming much more polished and personalized."
Mattingly argues that healthcare providers must integrate patient-facing phishing prevention into their comprehensive cybersecurity strategies. This includes proactive brand monitoring—using tools to identify when lookalike domains are registered—and ensuring that clinical, communications, and IT security teams are operating from the same playbook.
The Psychology of "Feeling Authentic"
Amy Bucher, Chief Behavioral Officer at the patient engagement firm Lirio, offers a deeper psychological analysis of why these scams are succeeding. She notes that patients often rely on mental shortcuts—heuristics—to navigate the barrage of digital information they receive daily.
"In many cases, patients aren’t deciding whether a message is authentic; they’re deciding whether it feels authentic," Bucher explains. This distinction is critical. When a healthcare organization sends generic, impersonal communications, it creates a "background noise" of digital outreach. In this environment, a well-crafted phishing email that mimics the familiar MyChart brand can easily bypass a patient’s natural skepticism because it mimics the tone of legitimate, professional medical correspondence.
Implications for Healthcare Systems
The implications of this campaign are far-reaching. While the breach is not "internal" to Epic, the damage to patient trust is real. If a patient is successfully defrauded after clicking a link they believed was from their trusted doctor, the primary point of failure is perceived as the health system itself.
Strategic Recommendations for Hospitals:
- Unified Communication Strategies: Hospitals should standardize the look and feel of their digital outreach so that patients can easily identify official messages.
- Education and Transparency: Providers need to clearly inform patients about the specific communication channels they use. If a health system never sends texts, they must explicitly tell patients this.
- Trust-Building as Defense: As Bucher suggests, the solution is rooted in deeper, more meaningful patient relationships. When a message is relevant, timely, and expected, it is much easier for a patient to detect a fraudulent impersonator.
- Vigilance Beyond the Firewall: Cybersecurity teams must shift their perspective to view their "brand" as a digital asset that requires protection, similar to data or hardware. This includes monitoring the web for typosquatted domains and unauthorized use of logos.
Best Practices for Patients: How to Stay Secure
Epic and healthcare leaders recommend a "zero-trust" approach to unsolicited digital communication. To protect their sensitive health and financial information, patients are encouraged to follow these four golden rules:
- Do Not Click: Never click on links in an email or text message that claims to be from a healthcare provider if the message was not specifically expected.
- Verify the Source: If a message claims to be from a provider, close the email and open a web browser to navigate directly to the health system’s known, official website or use their verified mobile app.
- Check for Unusual Requests: Be immediately suspicious of any message requesting payment, bank account details, or the installation of software to view health information.
- Contact Directly: If in doubt, call your healthcare provider’s office using a number found on the back of your insurance card or their official website. Do not use the contact information provided in the suspicious email.
Conclusion: The Path Forward
The current MyChart phishing campaign is a stark reminder that as healthcare becomes increasingly digitized, the "human element" remains the most vulnerable vector in the security chain. While technological safeguards and spam filters are essential, the ultimate defense against these sophisticated scams is a combination of patient education and the strengthening of the digital relationship between provider and patient.
As hospitals and health systems continue to battle these impersonators, the industry must prioritize transparency. By building a consistent, recognizable, and trustworthy communication style, healthcare organizations can create a defensive barrier where scammers stand out—not because of their "polished" emails, but because they fail to replicate the deep, relationship-based context that defines genuine patient care.
