Dies ist eine HTML Version eines Anhanges der Informationsfreiheitsanfrage 'Cyberattacks on EU hospitals'.


Pandemic profiteering 
how criminals exploit the 
COVID-19 crisis
March 2020


FOREWORD
The current crisis is unprecedented in the 
their capacity to exploit this crisis means we 
history of the European Union (EU). 
need to be constantly vigilant and prepared.
Fol owing the outbreak of the COVID-19 
Member States’ main focus is now on fighting 
pandemic, Member States have imposed 
the crisis from a health perspective – it is 
extensive quarantine measures, including 
important that we support their efforts. Crime 
travel restrictions, limitations to public life  
is a seriously disrupting factor and a diversion 
and lockdowns.
from national and EU efforts to ensure the 
health and safety of citizens. That is why it is 
However, law enforcement agencies are 
relevant to reinforce the fight against crime.
requested to perform their duties under 
any circumstances. In many cases, their 
We at Europol are in constant contact with our 
responsibilities have even been extended 
law enforcement partners across the EU and 
to maintain public order and safety and to 
beyond. During this crisis, more than ever, we 
support health authorities in their work. I 
must continue to support law enforcement 
would like to thank our frontline health, police  officers in the fight against organised crime 
and other critical staff for their tireless and 
and terrorism to enhance the security of 
relentless work.
European citizens. 
Needless to say, this situation also has 
The report published today provides an 
implications on the internal security of 
overview of how criminals adapt their 
the EU. Criminals have quickly seized the 
misdeeds to the COVID-19 pandemic. It is 
opportunities to exploit the crisis by adapting  based on information Europol receives from 
their modes of operation or developing new 
the EU Member States on a 24/7 basis and 
criminal activities. Organised crime groups  
intends to support Member States’ law 
are notoriously flexible and adaptable and  
enforcement authorities in their work.
CATHERINE DE BOLLE
Executive Director, Europol
2

WHICH FACTORS HAVE AN IMPACT ON CRIME?
The COVID-19 pandemic has forced national governments and the EU to enact various 
measures to limit the spread of the outbreak, to support public health systems, to 
safeguard the economy and to ensure public order and safety.
A number of these measures have a significant impact on the serious and organised 
crime landscape as well as the threat from violent extremists. To understand the 
impact of the COVID-19 pandemic on the internal security of the EU, it is crucial to 
identify the factors that prompt changes in crime and terrorism. These factors include:
High demand
Decreased 
for certain goods, 
mobility and flow 
protective gear and 
of people across 
pharmaceutical 
and into the EU
products
Citizens remain 
Limitations to 
at home and
public life will make 
are increasingly 
some criminal 
teleworking,
activities less 
relying on
visible and displace 
digital solutions
them to home or 
online settings
Increased anxiety 
Decreased supply 
and fear that may 
of certain illicit 
create vulnerability 
goods in the EU
to exploitation
3

CYBERCRIME
KEY FINDINGS
The global pandemic of COVID-19 is not only a serious health issue but also a 
cybersecurity risk. Criminals swiftly took advantage of the virus proliferation 
and are abusing the demand people have for information and supplies.
Criminals have used the COVID-19 crisis to carry out social engineering attacks, 
namely phishing emails through spam campaigns and more targeted attempts 
such as business email compromise (BEC). 
There is a long list of cyber-attacks against organisations and individuals, 
including phishing campaigns that distribute malware via malicious links and 
attachments, and execute malware and ransomware attacks that aim to profit 
from the global health concern.
 
 
Information received from law enforcement partners strongly indicates 
increased online activity by those seeking child abuse material. This is 
consistent with postings in dedicated forums and boards by offenders 
welcoming opportunities to engage with children whom they expect to be  
more vulnerable due to isolation, less supervision and greater online exposure.
4

The pandemic has an impact on Darkweb operations. Certain il icit goods wil  
become more expensive, as source materials become unavailable. Vendors on 
the Darkweb offer special corona goods (scam material) at discounts.
OUTLOOK
The number of cyber-attacks is significant and expected to increase further. 
Cybercriminals will continue to innovate in the deployment of various malware 
and ransomware packages themed around the COVID-19 pandemic. They may 
expand their activities to include other types of online attacks.
Cybercriminals are likely to seek to exploit an increasing number of attack 
vectors as a greater number of employers adopt telework and al ow 
connections to their organisations’ systems.
Attack on critical health infrastructure 
Cybercriminals carried out a cyber-attack on Brno 
University Hospital Brno, Czechia amid the COVID-19 
outbreak in Europe. Since a state of emergency was 
declared in Czechia on 12 March 2020, the attack was 
considered an attack on a critical infrastructure.
The incident prompted the hospital to postpone urgent 
surgeries and reroute new acute patients to a nearby 
alternative hospital.
The hospital was forced to shut down its entire IT 
network during the incident and two of the hospital’s 
other branches, the Children’s Hospital and the Maternity 
Hospital, were also affected.1
These types of attack during a public health crisis such as 
the COVID-19 pandemic are particularly threatening and 
carry very real risks to human lives.
1 ZDNet 2020, Czech hospital hit by cyberattack while in the midst of a COVID-19 
outbreak, accessible at https://www.zdnet.com/article/czech-hospital-hit-by-cy-
ber-attack-while-in-the-midst-of-a-covid-19-outbreak/ 
5

FRAUD
KEY FINDINGS
Fraudsters have been very quick to adapt wel -known fraud schemes to target 
individual citizens, businesses and public organisations.
These include various types of adapted versions of telephone fraud schemes, 
supply scams and decontamination scams.
The activities of fraudsters will continue to target an increasing number of 
victims across the EU to exploit anxieties as the crisis persists.
 
 
6

OUTLOOK
Fraud linked to the current pandemic is likely highly profitable for the criminals 
involved and they will attempt to capitalise on the anxieties and fears of victims 
throughout this crisis period. A large number of new or adapted fraud and scam 
schemes can be expected to emerge over the coming weeks and months with 
the potential for substantial financial damage to citizens, businesses and public 
organisations.
Criminals have also adapted investment scams to elicit speculative 
investments in stocks related to COVID-19 with promises of substantial profits.
The emergence of new fraud schemes and a further increase in the number of 
victims targeted can be expected. Even when the current crisis ends, criminals 
are likely to adapt fraud schemes in order to exploit the post-pandemic 
situation.
Supply scams
Businesses seeking to purchase supplies such as 
protective masks and other equipment are being targeted 
by scammers.
A Member State’s investigation focused on the transfer 
of €6.6 mil ion from a company to another company in 
Singapore to purchase alcohol gels and FFP2 and FFP3 
masks. The goods were never received.1
In another case reported by a Member State, a company 
attempted to purchase 3.85 mil ion masks and lost €300 
000. Similar supply scams of sought-after products have 
been reported by other Member States.2
1, 2 EUROPOL information.
7

COUNTERFEIT & 
SUB-STANDARD
GOODS
KEY FINDINGS
The distribution of counterfeit and/or sub-standard goods has been a key area 
of criminal activity in relation to the COVID-19 pandemic.
The sale of counterfeit healthcare and sanitary products as well as personal 
protective equipment (PPE) and counterfeit pharmaceutical products has 
increased manifold since the outbreak of the crisis. The advertisement and sale  
of these items take place both on and offline.
Some developments, such as the distribution of fake corona home testing 
kits, are particularly worrying from a public health perspective.
OUTLOOK
 
The sale of counterfeit and/or sub-standard goods on and offline is booming   
in the pandemic economy. There is particularly high demand for certain 
types of healthcare and sanitary products (masks, gloves, cleaning products, 
pharmaceutical products), which has created a substantial market for product 
counterfeiters, fraudsters and profiteers.
8

The number of offers of counterfeit and sub-standard good will continue to 
increase, particularly online. There is a risk that counterfeiters will use shortages 
in the supply of some goods to increasingly provide counterfeit alternatives both 
on and offline. This may entail sub-standard or counterfeit foods, hygiene items 
and other everyday goods.
Criminals take advantage of the high demand in hygiene  
products driven by the COVID-19 outbreak1 
Europol supported a global operation to target  The operation in numbers
trafficking counterfeit medicines. Operation 
Pangea, coordinated by INTERPOL and 
• 121 arrests;
involved 90 countries worldwide, took place 
• €13 mil ion in potential y dangerous 
between 3 and 10 March 2020. 
pharmaceuticals seized; 
The pandemic has opened up a business 
• 326 00 packages inspected;
opportunity for predatory criminals. 
Authorities around the world seized nearly 
• 48 000 packages seized;
34 000 counterfeit surgical masks, the most 
commonly sold medical product online. Law 
• 4.4 mil ion units of il icit 
enforcement officers identified more than 2 
pharmaceuticals seized worldwide;
000 links to products related to COVID-19. 
• 37 000 unauthorised and counterfeit 
The results of the operation reveal a worrying  medical devices seized (mostly surgical 
increase in unauthorised antiviral medications  masks and self-testing kits for HIV and 
and the antimalarial chloroquine. Vitamin C, 
glucose monitoring);
known for its immune-boosting properties, 
and other food supplements have been seized  • 2 500 links taken down (websites, 
around the world. Painkil ers and antibiotics 
social media, online marketplaces, 
also represented a significant portion of the 
adverts);
seizures.
• 37 organised crime groups dismantled.
CEri
m
ro ipnoalss t
up apkore a
te d
d t vhant
e opaegre o
atio f t
n bhe h
y facig
il h d
itati ema
ng infnod i
rm n h
atio yg
n eiexn
che  
ange and providing 
paro
nadu
lyticts d
cal s ri
upvpen b
ort.  y the COVID-19 outbreak1
1 Europol 2020, Criminals take advantage of the high demand in hygiene products driven by the COVID-19 outbreak, 
accessible at https://www.europol.europa.eu/newsroom/news/rise-of-fake-%E2%80%98corona-cures%E2%80%99-re-
vealed-in-global-counterfeit-medicine-operation
9

ORGANISED 
PROPERTY 
CRIME
FRAUD
KEY FINDINGS
Various types of schemes involving thefts associated with organised property 
crime have been adapted by criminals to exploit the current situation. This 
includes the wel -known ‘nephew’ or ‘grandchild’ trick and scams involving the 
impersonation of representatives of public authorities.
Commercial premises and medical facilities are expected to be increasingly 
targeted for organised burglaries.
The level of activity of criminals involved in organised property crime is 
expected to further increase during the crisis.
  
10

OUTLOOK
The same types of thefts using deception encountered during the COVID-19 
crisis have existed before, but criminals have adapted their modi operandi 
to the current situation. The number of attempts involving these types of 
thefts and scams is likely to increase across the EU.
While all EU citizens are at risk of being victimised, it appears certain fraud 
schemes are particularly targeting vulnerable members of society, such as 
the elderly. Fraudsters also approach victims at home by pretending to be law 
enforcement or healthcare officials offering testing for COVID-19 and other 
pretences to enter homes and steal valuables. 
Faking and entering  
Multiple Member States have reported a similar modus 
operandi for theft. The perpetrators gain access to 
private homes by impersonating medical staff providing 
information material or hygiene products or conducting a 
‘corona test’. 
A Member State reported a case where the perpetrators 
cal ed the victim to inform them that a relative is infected 
and in hospital. They claimed that doctors would have 
to come and take an immediate ‘corona test’. These fake 
doctors came to the victim’s home in protective clothing 
and masks in the middle of the night. The suspects then 
took an apparent swab sample from the victim’s mouth 
and wiped his forearms with apparent strips of paper to 
test it. He was then told that the evaluation of the test 
would take about five hours.
11

OTHER
CRIMINAL
ACTIVITIES
KEY FINDINGS
It is difficult to assess the short-term impact of the current pandemic crisis 
on drug markets, but it is likely to shift supply-demand dynamics and 
may disrupt il egal supply channels. Some reporting indicates stockpiling 
of certain drugs by consumers and supply shortages in (pre-)precursors 
and essential chemicals used in drug production in the EU, which wil  
likely impact on production output and prices. This area requires careful 
monitoring as supply shortages have the potential to translate into an 
increase in the number of incidents of drug-related violence between rival 
suppliers and distributors.
Migrant smuggling has been a key security and humanitarian chal enge to 
the EU over the last five years and remains so during the COVID-19 pandemic 
crisis. There is likely to be increased demand for services of migrant 
smuggling networks to enter the EU or to make secondary movements 
to circumvent the enhanced border control measures currently in place 
throughout the EU.
  
There are some concerns that the closure of establishments offering legal 
sex work may increase the number of incidents of sexual exploitation.
12


EUROPOL PROVIDES SUPPORT  OPERATIONAL ACTIVITIES
TO LAW ENFORCEMENT  
PARTNERS DURING THE CRISIS EU Law Enforcement Emergency Response 
Protocol for Large-Scale Cyber-Attacks
Europol is ready to support Member State law 
The possibility of a large-scale cyber-
enforcement authorities and other partners 
attack with serious repercussions in the 
throughout this unprecedented crisis. 
physical world and crippling an entire 
Europol continues to offer ongoing support in 
sector or society is no longer unthinkable. 
coordinating investigations between different 
To prepare for major cross-border cyber-
Member States and providing a sophisticated 
attacks, a European Union Law Enforcement 
platform for the vital exchange of information.
Emergency Response Protocol (EU LE ERP) 
was adopted by the Council of the European 
Crime and terrorism will find ways to continue to 
Union in December 2018. The Protocol 
operate across borders even in times of border 
gives a central role to Europol’s European 
closures and Europol urges our partners to share  Cybercrime Centre (EC3) and is part of the 
any pertinent investigations and intel igence to 
EU Blueprint for Coordinated Response to 
al ow us to identify cross-border links.
Large-Scale Cross-Border Cybersecurity 
Europol continues to be the information hub for 
Incidents and Crises.
the exchange of intel igence between Member 
States and with partner law enforcement 
The EU LE ERP serves as a tool to support 
authorities. In times of social distancing and 
EU law enforcement authorities in providing 
remote working, the ability to quickly and 
immediate response to major cross-border 
effortlessly share information is particularly 
cyber-attacks through rapid assessment, 
crucial in carrying on with investigations relying 
the secure and timely sharing of critical 
on analytical output.
information and effective coordination of the 
international aspects of their investigations.
Europol serves as a platform to exchange 
intel igence and provides Member States and 
other partners with solutions such as the 
EC3 has regular coordination cal s on the 
European Platform for Experts (EPE). These 
cyber impact of COVID-19 with the EU’s 
solutions are highly compatible with remote 
cybersecurity agency ENISA and CERT-EU, 
working and are ideal col aboration tools.
a col ection of security experts from EU 
institutions. 
STRATEGIC ACTIVITIES 
EUROPOL PREVENTION  
CAMPAIGNS 
Providing the Member States’ law 
enforcement authorities and our partners 
with an up-to-date situational picture is a 
Europol continues to inform the general 
key priority for Europol during this crisis. To 
public of these scams during the 
do this, Europol is committing resources to 
pandemic through preventive social media 
continuous monitoring of the situation and 
campaigns. Europol invites countries to 
to provide immediate support to Member 
work with us on shaping and disseminating 
States if needed.
these messages.
13

PANDEMIC PROFITEERING: HOW CRIMINALS EXPLOIT THE COVID-19 CRISIS
 
© European Union Agency for Law Enforcement Cooperation 2020.
Reproduction is authorised provided the source is acknowledged. For any use or 
reproduction of individual photos, permission must be sought directly from the 
copyright holders.
This publication and more information on Europol are available on the Internet.
www.europol.europa.eu