A locked account. A routine help desk call. A password reset that appeared to follow the process.
Then $24 million in insurance payments went to the wrong account.
In this episode of Behind the Breach, host Amber Wuollet follows an anonymized healthcare scenario involving a large organization where a threat actor gains access through a help desk call, moves through internal systems, and changes payment information inside an insurance portal.
She’s joined by DJ Hoeksema, Head of Managed Security Services at SpearTip, a Zurich company, to walk through how the incident unfolded — from the initial password reset, to the payment diversion, to the investigation that followed.
Together, they explore why identity-based attacks can be difficult to detect, how attackers take advantage of trusted workflows, and what organizations can learn from a case where each individual step appeared routine until the financial impact became impossible to ignore.
In this episode:
- Why social engineering is effective against help desk workflows
- How exposed personal information can weaken identity verification
- What threat actors look for once they gain access to an account
- Why changes inside business portals can be difficult to detect
- How delayed discovery can make fund recovery harder
- What incident responders look for when reconstructing the timeline
- How organizations can strengthen help desk processes after an incident
Behind the Breach is a Cowbell podcast exploring what happens inside a cyber incident — and what organizations can learn before one happens to them.
Guest: DJ Hoeksema, Head of Managed Security Services, SpearTip, a Zurich company
Host: Amber Wuollet, Director of Product & Lifecycle Marketing, Cowbell
Disclaimer: This episode is for informational purposes only and does not constitute legal, insurance, or cybersecurity advice.
