cross-posted from: https://lemmy.ca/post/66558868

tl;dr: Healthcare workers in Newfoundland and Labrador, Canada were taunted by their employer with the promise of one (1) paid day off, but it was a gotcha to teach nurses not to click links in their emails. Their IO and “VP of digital health” says he and the health authority are investigating themselves for wrong-doing (“not who we are blahblah”).

“Our members deserve better than to be taunted with the promise of a day off after the incredible amount of work and sacrifice they made to get CorCare up and running," [Jerry Earle, president of Newfoundland and Labrador Association of Public and Private Employers] wrote in a statement.

He said members were denied vacation time and worked long hours due to the CorCare launch.

"To use those sacrifices as the basis for a phishing test is nothing short of cruel.”

…

“Nurses and other health-care professionals have worked through enormous pressure over the last number of years, including ongoing staffing shortages, burnout, organizational restructuring, and the challenges connected to the rollout of CorCare,” [Registered Nurses’ Union Newfoundland and Labrador president Yvette Coffey] said in a statement Wednesday morning.

“To use the promise of an additional paid day off as the hook for a phishing exercise was in very poor taste.”

…

Newfoundland and Labrador Health Services said [in the email they sent] in recognition of the work [employees had] put in during the recent implementation of the new digital health information system CorCare, all employees would receive a paid day off.

It came with instructions to register for the day off by June 17 by clicking on a link.

“Thank you for the care, professionalism, and commitment you continue to bring to N.L. Health Services and to the people and community we serve,” the email concluded.

  • bitwise@lemmy.ca
    1·
    2 hours ago

    Scammers are literally looking for effective ways to get you to read and click without looking and this was a perfectly valid thing to do, as much as it might suck.

    I once had a test email come in…that was signed with a valid internal cert for our network which I immediately pointed out to them when they tried to bother me about it.

    So, unless it was one of those sort of situations, I don’t have much sympathy.

    Healthcare providers are some of the juiciest targets for ransomware, and unless they’re all going to stop using email, they need to be careful about shit like this.

    AI has made it terrifyingly easy to put together clone-correct pages that survive more than casual scrutiny, so expect more scams that look legit.