What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

Plagued with Cyberattacks: As PE Firms Buy Up Healthcare Organizations, How to Protect Against Growing Threats

BY Eldon Sprickerhoff

October 25, 2023 | 6 MINS READ

Cyber Risk

Ransomware

Cybersecurity Strategy

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT

A variety of market, societal and economic challenges in recent years have made it harder for healthcare organizations, big and small, to maintain a thriving, profitable practice. To shore up the business and allow the continued treatment of patients, many Healthcare Delivery Organizations (HDOs) have signed agreements to be acquired by private equity firms.

Private equity's investment in healthcare has rapidly increased over the last few years, particularly in the acquisition of physician practices, senior living facilities, and dental practices. In fact, 2022 was the second biggest year on record for healthcare private equity deals in the U.S.

Healthcare is an attractive industry for private equity because, as stated at the 2022 AMA Annual Meeting, there’s an opportunity to invest over a horizon of 5-7 years, historically at a 20-30% profit, while reducing spending and waste in healthcare at the same time.

Unfortunately, this trend is also attractive to bad actors on the hunt for highly sensitive medical data, including Protected Personally Identifiable Information (Protected PII) and Protected Health Information (PHI and ePHI). HDOs of all sizes are particularly vulnerable and targeted by cyberattacks because they possess a tremendous amount of information of high monetary and intelligence value to cybercriminals and nation-state actors. The more sensitive the data, the higher the probability threat actors will attack it.

For cybercriminals, stealing patient data stored from all those connected devices is the big win – one record can elicit up to $250 on the Dark Web, approximately 50x more than the next best stolen data, credit, and debit card numbers. Ransomware is a particularly acute problem as ransom demands are also higher at $4.5M on average because the adversaries know that patient lives are at stake.

The number of individuals affected by healthcare attacks has tripled in just three years, according to breach data reported to the U.S. Department of Health and Human Services (HHS) by healthcare organizations. These attacks can take a healthcare facility offline, leading to the disruption of care, resulting in longer lengths of stays in the hospital and delays in procedures and tests.

When cyberattacks happen to a healthcare provider, the cost – financial, reputational, and patient mortality – can be astronomical. For example:

Moreover, healthcare is a unique business, encompassing hundreds or even thousands of staff at one location, where only a small proportion are IT professionals. Their first priority is the delivery of healthcare so when budgets are tight, the patients get priority (understandably so), not technology.

Plus, most healthcare facilities today have dozens of vendors installing and maintaining technology solutions to improve patient care outcomes and/or the efficiency of the business. With the onset of the Internet of Things (IoT), many healthcare items are networked today, such as insulin pumps, heart monitors, and many more. It should be also noted that the IT departments within healthcare facilities rarely manage the third-party vendor systems themselves.

Cybercriminals are known to track HDOs that receive PE funding for two primary reasons: a) the infusion of capital and b) the fact that many of these companies may not have sophisticated IT and cybersecurity solutions to prevent or detect a cyberattack.

The reality is that while PE firms are known for their financial expertise, many lack the experience in healthcare information security and may not have adequate expertise or resources needed to manage complex healthcare regulations under HIPAA rules.

The fact that healthcare organizations utilize multiple disparate platforms for patient records, booking tools, payment systems, and more (often on a surprisingly “flat” network topology) makes them even more vulnerable due to multiple points of entry. Threat actors are adept at bypassing traditional defenses like firewalls and antivirus systems, often remaining undetected within the environment for days or weeks before ‘detonating’ a ransomware attack or disabling services.

Additionally, in recent years, healthcare organizations have even fallen prey to a new trend of double-extortion and triple-extortion ransomware attacks. In a double-extortion ransomware attack, the threat actors exfiltrate data and threaten to sell it unless they’re paid a higher ransom. In a triple-extortion ransomware attack, they threaten to launch a distributed denial-of-service (DDoS) attack that could further disrupt healthcare services.

To mitigate these risks, it’s important for PE firms and the HDOs being acquired to prioritize cybersecurity when executing a deal to minimize surprises. This involves conducting thorough cybersecurity assessments, implementing effective security protocols and systems, and providing ongoing employee training and education.

The first step in managing cyber risk in today’s threat environment is to adopt the mindset that cybersecurity isn’t solely an IT problem to solve – it’s an organizational risk to manage. What’s more, managing your cyber risks is only the first step; to truly stay ahead of the ever-evolving threat landscape, the goal should be to build a truly cyber resilient security operation so you can anticipate, withstand, and recover from the toughest cyberattacks.

To that end, I recommend adopting the following cybersecurity practices:

It’s also important to remember that just because a healthcare organization hasn’t yet been directly affected by ransomware doesn’t mean it won’t ever be. And, even when PE firms have cyber insurance coverage, the insurance provider may or may not cover a security breach (given that many insurance firms don’t like to pay out when they can point to signs of contributory technical negligence).

By prioritizing cybersecurity in their acquisition strategies and investing in appropriate technology and training, private equity firms can better safeguard both their investment and medical records, demonstrating a commitment to patient privacy and security.

Implementing a cybersecurity strategy that builds resilience and partnering with a reputable MDR firm will greatly diminish the impact a cyberattack has on a healthcare system, keeping both patients and the business itself safer.

Eldon Sprickerhoff
Eldon Sprickerhoff Founder and Advisor

Eldon Sprickerhoff is the original pioneer and inventor of what is now referred to as Managed Detection and Response (MDR). In founding eSentire, he responded to the incipient yet rapidly growing demand for a more proactive approach to preventing and investigating information security breaches. Now with over 20 years of tactical experience, Eldon is acknowledged as a subject matter expert in information security analysis. Eldon holds a Bachelor of Mathematics, Computer Science degree from the University of Waterloo.

Read the Latest from eSentire