MyChart phishing emails surge, targeting 190 million users

Phishing emails targeting MyChart users have surged, putting roughly 190 million patients at risk of having their private information stolen through fake login pages and bogus medical alerts. The online healthcare portal, used worldwide for communication with providers, has reported an increase in realistic scam emails aimed at tricking patients into clicking malicious links.

One version of the scam claims a recipient’s recent medical results are ready and includes a link to sign in to a MyChart account, according to MyChart. That link leads to a fake login page that looks identical to the real one. If a user enters their credentials, they may be sent to another page displaying an urgent warning about critical patterns in their blood work that need review.

Continuing to click through the prompts can expose users to malware designed to steal private information or redirect them to a website built to harvest that information, MyChart says.

Another version of the phishing email tells recipients they are eligible to receive a complimentary “Medicare Health Kit.”

MyChart’s anti-fraud page advises patients to be skeptical of any email from MyChart that does not include the name of their doctor or healthcare provider.

“Real MyChart emails come from your own healthcare organization or MyChart Central and show the name of the organization,” the warning states. “If you are unsure if an email is real, do not click any links or buttons in the email. Instead, open MyChart using the mobile app or the official URL for your organization’s MyChart website.”

Scamicide notes that the legitimate MyChart will never ask users to click on links. Patients who receive a suspicious email are urged to contact their healthcare provider directly to verify it.