Healthcare industry growing target for cybercriminals

Over the next several weeks, we will look at cybersecurity within the context of the healthcare industry. The fact is, the number of breaches reported by medical organizations increased from just 16 in 2012 to more than 119 breaches in 2017. Thus, it’s important that healthcare professionals recognize the growing risk of data breaches and cyber-attacks so they can take the necessary precautions to avoid them. But before we can go any further, the healthcare industry needs to understand why it’s a growing target.

The healthcare industry is a growing target

If a cyber-attack was launched against the healthcare system of North America in its current state, there would probably be little to stop it. But what are the actual chances of a wide-scale attack?

The American Recovery and Reinvestment Act of 2009 requires that U.S. medical organizations publicly report criminal breaches affecting 500 or more individuals. The data below presents an exponential upward trend in U.S. healthcare data breaches.

Figure 1: U.S. Healthcare Data Breaches

As previously mentioned, the number of breaches reported increased from just 16 in 2012 to more than 119 breaches in 2017. That’s a big difference. Not to mention these numbers only reflect detected large-scale breaches, which represent just a fraction of successful attacks in the wild.

The threat is real

On May 12, 2017, organizations around the world fell victim to a new variant of ransomware called WannaCry. The attack targeted 200,000 machines in more than 150 countries, spreading itself through the Server Message Block (SMB) protocol, which is used by Windows computers to share files.

The attack caused chaos for Britain’s National Health Service (NHS), crippling its ability to properly treat patients. Thousands of operations and appointments had to be canceled as a result of the attack, which could have been prevented by installing the patch released by Microsoft two months earlier.

What makes healthcare so vulnerable to cyber-attack?

Fortunately, the eSentire Threat Intelligence team set out to investigate what makes the healthcare industry both vulnerable to cybercrime and attractive to threat actors. What they’ve found is three-fold:

1. The healthcare industry’s poor security posture makes it susceptible to the most basic opportunistic attacks.
2. The value of patient records and the critical role medical facilities play in national stability make healthcare an attractive target for both financially-motivated and politically-motivated attacks.
3. Delivery of ransomware through phishing is a common attack vector experienced by healthcare providers, in addition to Point-of-Sale attacks and exploitation of vulnerabilities on exposed services.

In addition to these primary vulnerabilities, there are other things to consider. Many healthcare organizations don’t invest very much in hiring enough skilled cybersecurity practitioners, which can put them at a disadvantage in defending against cyberthreats. Furthermore, there tends to be insufficient investment made in the technologies needed to mitigate a data breach. These two factors, paired with outdated systems, applications and technologies makes for a very difficult cybersecurity challenge.

Hope need not be lost, though. For each vulnerability mentioned, there are measures that healthcare organizations can take to counteract them. Besides spending more money on cybersecurity resources, there are strategic measures you can take to reduce the threat to your organization.