SIM Swap Attack Incident Response Checklist for a Veteran Trauma Residential Center

Incident Identification

Act immediately when staff report sudden loss of cellular service, unexpected password resets, or new-device login alerts. Treat these as probable SIM swap events impacting clinical continuity and protected health information. Prioritize SIM swap fraud detection in your SIEM and identity provider alerts.

• Flag signals: repeated MFA prompts, OTP texts not received by the user, or voicemail changes.
• Correlate identity, EHR, email, and MDM logs for rapid user-to-device mapping.
• Open an incident ticket and begin incident logging with precise times, owners, and decisions.
• Classify severity, affected roles (clinicians, case managers, billing), and potential PHI exposure.

Initial Containment

Isolate risk within minutes. From a safe device, force sign-out of affected accounts, invalidate tokens, and require step-up authentication that does not rely on SMS or voice. Assume the attacker may attempt multi-factor authentication bypass using the swapped number.

• Immediately perform mobile carrier notification to freeze the line, reverse unauthorized SIM changes, and apply a port-out lock.
• Temporarily disable SMS/voice for MFA org-wide if indicators suggest broader targeting.
• Rotate passwords, app passwords, and recovery factors; block push fatigue by requiring number matching or hardware keys.
• Quarantine risky endpoints via MDM and restrict access to EHR, email, and billing until identities are re-verified.

Communication

Use secure, out-of-band channels—never SMS or voice tied to the compromised number. Establish a staffed incident bridge in your approved collaboration tool and maintain a single source of truth for updates.

• Notify privacy, security, clinical leadership, and IT operations with clear roles and timelines.
• Coordinate with vendors (EHR, payroll, telehealth) using pre-validated contacts only.
• Provide staff guidance for patient-facing conversations that protect veteran privacy and avoid alarming language.
• Record all communications in the incident log to support later forensic analysis and reporting.

Investigation

Conduct targeted forensic analysis to confirm scope and root cause. Build a minute-by-minute timeline from identity provider, email, EHR, MDM, VPN, and firewall logs. Preserve evidence with chain-of-custody notes.

• From the carrier, request swap timestamps, previous/active IMSI or eSIM identifiers, and any support interactions.
• Identify accounts where the attacker changed MFA methods, recovery addresses, or forwarding rules.
• Check for data access or exfiltration (PHI, veteran contact lists, billing data) and attempted financial fraud.
• Determine whether social engineering targeted the center, the carrier, or both; update training accordingly.

Remediation

Eliminate the attacker’s footholds and harden identity. Prioritize account takeover mitigation by replacing SMS with phishing-resistant MFA (FIDO2 security keys or passkeys) for admins, clinicians, and high-risk roles.

• Re-enroll MFA on verified devices; remove phone numbers as recovery factors where policy allows.
• Enforce carrier protections: port-out lock, account takeover protection flags, and strong account PINs.
• Rotate credentials, API keys, and OAuth secrets; review delegated mailbox and inbox rules.
• Add adaptive policies: impossible travel detection, device compliance checks, and step-up for sensitive apps.

Recovery

Restore normal operations gradually, with heightened monitoring. Confirm all affected users can access clinical systems without relying on compromised factors, and validate that patient communications flow through verified channels.

• Run continuous detection for re-attack attempts, anomalous MFA changes, and new device enrollments.
• Issue new numbers or eSIM profiles only after carrier locks are enforced and identities are re-verified.
• Protect user data during recovery through least-privilege access, encryption at rest/in transit, and strict session controls.
• Deliver targeted staff refreshers on SIM swap indicators and secure help desk verification.

Documentation and Reporting

Maintain comprehensive incident logging: who did what, when, why, and with which approvals. Archive artifacts (tickets, logs, carrier confirmations, user attestations) to support audits and lessons learned.

• Conduct a formal risk assessment and document forensic analysis outcomes, scope, and data impact.
• Coordinate regulatory compliance reporting with counsel (e.g., HIPAA Breach Notification Rule and applicable state requirements) and fulfill contractual obligations to partners.
• Capture a post-incident review with concrete control improvements, owner assignments, and deadlines.
• Update playbooks, help desk caller verification, carrier escalation paths, and MFA enrollment policies.

Bottom line: rapid identification, decisive containment, disciplined communication, evidence-driven investigation, and strong identity hardening are your best defenses against SIM swap threats while safeguarding veteran trust.

FAQs.

What are the first steps to take after a SIM swap attack?

Immediately revoke sessions, force password and factor resets, and perform mobile carrier notification to freeze or reverse the swap. Disable SMS/voice MFA, switch to secure factors, and begin incident logging while you assess scope.

How can a veteran trauma center prevent SIM swap attacks?

Adopt phishing-resistant MFA, enforce carrier port-out locks, and require strong account PINs. Use adaptive access controls, staff training against social engineering, and rigorous help desk verification to block multi-factor authentication bypass.

What communication methods should be used during a SIM swap incident?

Use approved secure chat or conferencing from trusted devices, never the compromised number. Maintain a single incident channel, verify vendor contacts out-of-band, and record decisions for forensic analysis and regulatory compliance reporting.

How is user data protected during recovery?

Apply least privilege, re-verify identities, and re-issue factors on trusted devices. Encrypt data, monitor for abnormal access, and phase access restoration while validating that account takeover mitigation controls are fully effective.