Vaccines for sale on dark web as criminals target pandemic profits

Vendors were offering coronavirus vaccines for sale on hidden parts of the internet days after the first Covid-19 shot was approved this month, as criminals seek to profit from global demand for inoculations.

One such offer on the so-called dark web, traced by cyber security company Check Point Software, was priced at $250 with the seller promising “stealth” delivery in double-wrapped packaging. Shipping from the US via post or a leading courier company would cost $20, with an extra $5 securing overnight delivery.

Another vendor claimed this week to have vaccines developed by Chinese manufacturers Sinopharm and Sinovac for sale at $750 for two doses, payable in bitcoin. The advertisement was illustrated with a stock photo, which did not correspond to the two Chinese vaccine makers’ normal packaging. When asked how the vaccine should be stored, the seller suggested a cold box or refrigerator.

Experts said that many of the vaccines for sale on the dark web were either fake or would never be shipped. Similar offers have been posted by other vendors for months. But whether or not sellers have now gained access to authentic products, the adverts reflect the type of criminal opportunism that experts warn will increase as demand for approved vaccinations outstrips supply next year.

Interpol and Europol warned this month of a probable “onslaught” of criminal activity linked to Covid-19 vaccines, ranging from online fraud and cyber crime to theft and the sale of fake or substandard doses. Even empty vaccine vials, which could be illegally refilled, could be targeted, according to Europol. Counterfeit vaccines were a significant public health threat, “ineffective at best, and toxic at worst”, it said.

Amy Shortman, a pharmaceutical logistics expert at Overhaul, which deals with supply chain security, said: “There will always be a market for people who wouldn’t necessarily have access to that medicine and wanted to protect themselves and their families.” She cited the existing illicit market for chemotherapy medicines, despite how difficult the drugs are to administer. “There will be, certainly globally, a lot of money that can be made by criminals.”

The risk that vaccines will be stolen and diverted on to the black market has put the pharmaceutical industry on high alert as it prepares to support the biggest global vaccination effort in history.

“We need to tell people at the vaccine centres that they carry gold,” said Thorsten Neumann, head of the European arm of Tapa, a supply chain security association. “Criminals don’t see a vaccine load, they see money,” he said, highlighting the risk that supply chain workers with existing links to criminal networks could provide information to enable those groups to target shipments.

The industry is prepared. Efforts to improve security in recent years have led to manufacturers introducing regular audits and vetting of supply chains, as well as minimising human contact, stops and handovers during distribution.

“Pharmaceutical manufacturers are already spending a lot of time to make sure their products and their supply chain is secure,” said Chuck Forsaith, head of the Pharmaceutical Cargo Security Coalition, an industry association. “I don’t think there is any other industry on the globe that is as prepared for something like this.”

Shipments are regularly fitted with real-time digital devices which measure temperature and location, reporting back any divergence from the plan. The technology ensures the integrity of the supply chain, though it could also be a vulnerability.

While Mr Forsaith said there appeared to be no evidence of any physical raids on the Covid-19 vaccine supply chain so far, numerous cyber attacks have been documented.

Hospitals and healthcare facilities have been hit with a barrage of phishing and ransomware attacks since the pandemic began.

“We have seen very targeted attacks related to the vaccine”, said Evangelos Ouzounis, head of the secure infrastructure unit at Enisa, the EU Agency for Cyber Security. “The health sector is not very mature in terms of cyber security.”

In one attack reported this month, researchers at IBM found hackers had impersonated an executive at a Chinese supplier of ultra-cold refrigeration in an attempt to steal logins and passwords. The highly sophisticated attempt was likely backed by a nation state hoping to either disrupt the cold storage vaccine supply chain or steal intellectual property, the researchers said.

The lack of access to coronavirus vaccines in countries such as the US and UK, where health authorities are prioritising the vulnerable or those working in specific industries, means a secondary market for credentials allowing individuals to “jump the queue” was also likely to thrive, according to data firm Experian.

“There’s already offerings and chat rooms [for] valid credentials of people with pre-existing [health] conditions”, said Michael Bruemmer, vice-president of Experian Data Breach Resolution. “You can pre-book your order for the vaccine [on the dark web] so we think the dark web is only going to get busier.”