SPOOFING ATTACK SENDS VICTIMS TO WEBSITE IMPERSONATING NEW YORK'S OFFICIAL HEALTH PLAN MARKETPLACE

THE FREE LANCE NEEDS YOUR DONATIONS TO SURVIVE. DONATE HERE.

Internet hackers are targeting millions of New Yorkers attempting to renew or sign up for health insurance through the State's official health plan website.

The massive spoofing scheme is robbing them of personal information, causing victims to be bombarded with spam telephone calls, text messages and voicemails from entities claiming to sell healthcare coverage.

The scam is potentially affecting millions of New Yorkers attempting to renew their health insurance. More than 1-in-3 obtained coverage through the State's official website.

New Yorkers' health care coverage was paused-in-place since the Wuhan virus pandemic started in the Spring of 2020. The State Department of Health announced the pause would gradually be lifted as part of a "Public Health Emergency Unwind." The first notices of required renewal went out last June, according to the Department of Health's website. More than 7 million people need to re-register, the Department says.

But victims attempting to re-register through the official State Department of Health website are instead led to a private website masquerading as the official one: formally New York's "Official Health Plan Marketplace."

New York's Official Health Plan Marketplace is at www.nystateofhealth.ny.gov. The fake website is www.nystatehealthplans.com.

A spoofing attack is a specific type of Internet hacking technique. It involves disguising "an email address, sender name, phone number, or website URL--often just by changing one letter, symbol, or number--to convince you that you are interacting with a trusted source," according to the F.B.I.

This spoofing attack begins with the paperwork the State Department of Health recently sent out to millions of New Yorkers informing them to "ACT NOW! Renewal Rules Have Changed". The paperwork warns: "You may lose your coverage if you do not finish your renewal ON TIME." The paperwork instructs people to "Sign in at www.nystateofhealth.ny.gov or call us to get started."

People attempting to connect to the official website, however, are being led to the fake one. If you're using Safari, DuckDuckGo or Edge and enter the web address of the real New York State Official Health Plan Marketplace,  www.nystateofhealth.ny.gov, the browser won't connect and will say the website is not available. If you then search using those browsers, the first listing is the fake website.

The fake website is, of course, designed to look like the real website. Many people click it. The homepage of the fake website prompts victims to enter personal information including home address, birthday, telephone number and email address. Then it tells people they will be contacted. The telephone calls begin within minutes.

One victim, in upstate New York, was bombarded with 15 spam telephone calls, three text messages and three voice mails in less than an hour.

The scheme does not appear to be affecting Google browsers.

The Free Lance reached out to the New York State Department of Health, which operates the State's Official Health Plan Marketplace, and New York State Attorney General Letitia James' office, for comment. If they respond this report will be updated.

The fake website says it's owned by an insurance agency called QuoteLab in Los Angeles, California. But inquiries to QuoteLab are managed by a marketing company called MediaAlpha. An emailed inquiry to MediaAlpha concerning their spoofing attack on New York's official Health Plan Marketplace went unanswered.

Victims of the spoofing attack or any Internet crime can file a complaint with the F.B.I. here.

Any New Yorker who suspects that they are a victim of an online scam can report it to New York Attorney General Letitia James by submitting a complaint online or calling 1-800-771-7755.  

THE FREE LANCE NEEDS YOUR DONATIONS TO SURVIVE. DONATE HERE.