Scammers impersonating MyChart to steal personal information, install malware

A warning for millions of people who use MyChart to check their medical records. Scammers are now impersonating the patient portal, using realistic-looking emails, texts, and websites to try to steal personal information and, in some cases, get malware on your computer.

It doesn't appear these MyChart scams have reached Chicago area hospital systems yet, but Northwestern Medicine is warning patients to be aware, and offering tips to protect their personal information.

The scams look like a message from your doctor's office, and include the MyChart logo, a link to check your medical results, and maybe even a warning that something needs your immediate attention.

Jake Braun, executive director of the Cyber Policy Initiative at University of Chicago, said that sense of urgency is exactly what scammers are counting on.

"It's convincing, because one wouldn't assume that their doctor would be the source of a scam," he said.

Braun said the way the scams are rolled out have become even more sophisticated.

"Now, with AI, they can make the usage and grammar so natural that folks just assume it's their doctor," he said.

Epic — the company behind MyChart — said scammers are using fake websites that can look almost identical to the real thing.

In one example, a phony MyChart site shows users fake medical results and then claims they need to complete a verification step.

The instructions can actually tell people to press certain keys on their computer — a move that can allow malware to be installed.

Some scam messages promise a free "Medicare kit" or other benefit, and ask for personal or payment information.

Braun said parents need to be aware these scammers are now targeting young people-

"The fastest growing group being targeted in the country right now are actually children, minors, because the kids all have phones. They don't know what they can click on and can't click on, and as a parent, I worry as much about my father and what he's being sent as I do my 15-year-old kids and what they're seeing online. And I think people really need to educate their children on this as well, because they're a top target," he said.

Braun said the operators are often targeting Americans, but working outside the United States, and there needs to be more federal resources put into tracking down who's behind the scams.

"It's unclear who exactly the bad buys are in this case. Oftentimes these are Russian organized crime groups. Sometimes domestic. Oftentimes there are groups that are actually in basically slave labor camps in places like Myanmar that are forced to do these types of scams," he said.

If a website that appears to be MyChart tells you to run a computer command, download a program to see your lab results, or override a security warning, you should stop.

Epic said MyChart itself has not been compromised. The company said these attacks are using the MyChart name and brand to trick people, so patients can continue safely using the portal, but should be careful about how they access it.