Where Did the Viagra Spam Come From? This Time, From Pfizer

Pfizer was exposed last week after ignoring warnings from an Internet security company that spammers had compromised the pharma giant's computers.

According to an online article published last week by popular technology magazine Wired, computers throughout Pfizer were infected with malware, a software program that allows a third party to capture passwords and user log-ins and to data mine private information. The unknown spammer was sending e-mails through Pfizer computers promoting, among other things, the sale of Viagra.

Support Intelligence, a spam-infestation monitoring company, red-flagged Pfizer when spam blocks confirmed that the e-mails were coming from computers within the company. "We approached Pfizer on multiple occasions to tell them about this issue," said Rick Wesson, CEO of Support Intelligence. "We did everything we could to help mitigate the problem, but for whatever reason internally, they didn't do it. Not even after repeated requests to fix it."

On Aug. 24, Pfizer sent a memo to its employees admitting that a computer security breech has affected approximately 34,000 current employees, former employees, colleagues, and healthcare professionals.

"This was done without Pfizer's knowledge or consent, in violation of Pfizer policy," the memo stated. "The individual is no longer employed by the company."

According to Wesson, Pfizer is just one of many Fortune 500 pharma companies plagued with this problem. His company outs many of them through its blog. "Organizations that are having these kinds of infections are having their intellectual properties exfiltrated to foreign countries," Wesson said. "That is the problem here, not that Viagra is being advocated from a compromised computer on Pfizer's network."

Others, however, feel that Pfizer is not wholly at fault and that the story might have been sensationalized due to the fact that the spam in question was advertising Pfizer's erectile dysfunction drug. Viagra ads represented only a fraction of the spam sent through the security hole; other ads included those for penis enhancers and highly counterfeited drugs, such as Oxycontin.

"This type of problem could happen to any large company with a system like this," said Jay Bolling, president of Roska Healthcare Advertising. "I do think Pfizer is the victim in this case. But at the same time, the company should acknowledge the problem and rally the public around trying to offset this problem in the future. It should also educate the users of the system."

Bolling recommends that companies follow basic Internet maintenance, such as system updates, virus-prevention updates, and log-file reviews, to isolate data that is vulnerable.

"A group like Pfizer really has to weigh security access when it has thousands of representatives running around the system, downloading various files, and being able to access things on its servers," Bolling said. "When you have thousands of salespeople on the road with laptops connected to different systems on the company network, anything can happen."