Healthcare systems were attacked by hackers more than systems of any other industry recently. Healthcare continued to be a lucrative target for hackers. These threats will continue and cybercriminals will likely get more creative despite better awareness among healthcare organizations at the executive level for the funding needed to protect themselves. Health care is one of the most important industries. While other sectors focus on products people want, the medical field provides a service the public actually needs. Sadly, this altruism isn’t rewarded.
Hackers are increasingly targeting these institutions with their nefarious plots, and a lot of patients are getting caught in the crossfire. The problem here is that quite a lot of people don’t understand the threat facing the health care industry right now. News reports of retailers and financial institutions getting hacked have people thinking these are the most targeted sectors, but this just isn’t true. Analysis of 10 years of cyber attack data actually points to health care as being the most hacked industry out there.
Let us take a look at some of the recent Healthcare Sector’s Cyber Attacks around the world.
• SINGAPORE, July 20, 2018 – Hackers breached the Singapore government’s health database with a deliberate, targeted and well-planned cyberattack, accessing the data of about 1.5 million patients, including Prime Minister Lee Hsien Loong, for almost a full week. The cybercriminals initially breached a front-end workstation to gain privileged account credentials to obtain privileged access into the database. Officials said they detected unusual activity on July 4, but the hack began on June 27. The stolen data contained demographic information and patient identification numbers. Medical information like diagnoses and test results weren’t included. However, for 160,000 patients, including the prime minister, the hackers stole data on outpatient-dispensed medications.
• U.S.A, June 28, 2018 – The thedarkoverlord sold a stolen database of health insurance records from more than 9.3 million patients across the U.S. The advertisement, found in the same deep web marketplace, touts, “This product is an extremely large database in plaintext from a large insurance healthcare organization in the United States. It was retrieved using a 0-day within the RDP protocol that gave direct access to this sensitive information.”
• UNITED KINGDOM, May 12-16, 2018 – Hackers targeted NHS. The attack used malware called ‘WannaCryptor’ or ‘WannaCry’ to exploit a vulnerability in Windows XP, which many NHS systems use despite previous concerns. NHS staffs were locked out of their computers, disrupting thousands of patients across the UK as appointments and operations were forced to be cancelled. Files saved on the computers, like patient notes and appointment details, were impossible to access or retrieve without paying a ransom of $300 (£230) in Bitcoin.
• U.S.A, March 22, 2018 – 270,000 patient records breached in Med Associates Hack. Officials discovered the breach on March 22 when an employee workstation began displaying unusual activity. An investigation by a Med Associates third-party forensics team determined a hacker accessed the workstation and may have accessed patient data. The affected data contained demographic information, addresses, dates of service, medical data and insurance identification numbers. This type of information can be used by hackers for medical fraud.
• U.S.A, March 18, 2018 – Baltimore-based LifeBridge Health and LifeBridge Potomac Professionals was hit by a malware attack that potentially exposed the private information of about 500,000 patients for more than a year. However, the investigation that followed found the hackers first gained access to the EHR and servers on September 27, 2016. And the breached data included demographic information, dates of birth, medical history, clinical and treatment information, insurance data. For some patients, Social Security numbers were included.
There are also a huge number of opportunities for attacks on healthcare systems simply due to the extent to which they rely on technology. Healthcare today makes massive use of expensive technology, not just in computer systems and hospital equipment but also devices attached to and even embedded in the human body, such as fitness monitors or digital pacemakers. There are also many ways in for a healthcare hacker, from data networks to mobile applications and even non-medical systems such as CCTV. In particular, the spread of the Internet of Things, the connection of increasing numbers of devices and objects to the internet, is increasing the number of potential access points for hackers. Unlike many of the more trivial uses for the Internet of Things, connected medical devices have obvious benefits because they can instantly exchange useful data or instructions with medical staff. This is where some of the greatest dangers lie because the devices are often involved in critical procedures or treatments. Interference with the signals to a robotic surgical tool, for example, would be devastating.
Why is Cybersecurity so Important in the Medical Sector?
Healthcare is heavily reliant on technology these days, not just for hardware that can help cure illnesses but also when it comes to sending, retrieving, and storing data. Health informatics plays a crucial role in the healthcare industry because it makes it much more efficient. However, because of cyber threats, it means technology isn’t always reliable. Why do many healthcare entities concentrate on preventing cyber attacks by investing millions and why is cyber-security so important to the industry? Cybersecurity saves the healthcare industry millions. One major benefit of cyber-security in the healthcare industry is that it helps prevent the leaking of patient information. The healthcare industry saves money because professionals are much more efficient in the service they provide. For healthcare organizations, the repercussions of a data breach are daunting. In addition to the loss of reputation and patient trust, they risk incurring huge revenue losses from expenses such as those related to the investigation, forensics and mitigation of the damage done by such a security incident, billing issues, and costs involved to provide affected patients with reparational support such as identity theft protection and credit monitoring services.
The healthcare sector has a lot of valuable data. Although a bank may have more money sitting around than a hospital might, hackers aren’t really looking to go after straight cash when they break into a network. To begin, financial organizations generally have quite a lot of security surrounding their accounts and breaking through these defenses is tough. On top of that, money is traceable, and a hacker would have to launder any amount stolen from a bank. Information, on the other hand, is a lot harder to track. What’s more, a hacker who sells personal information stolen from a hospital has the ability to simply offload the responsibility of making money off of the data on the black-market customer who ends up buying it. The cybercriminal simply takes his payday and goes back to the shadows, once again separated entirely from the information he’d just stolen. Think Security. Think Ahead.