Cyberattacks in the Healthcare Industry

Per a recent data breach report by IBM, 83% of all enterprises surveyed have experienced over one breach in 2022. Healthcare was hit hard, with the cost of a breach going up by 42% since 2020. For the 12th year in a row, the healthcare industry had the highest average cost of a data breach. Another survey shockingly found that 18% of healthcare employees are willing to sell confidential information to unauthorized parties for as little as $500 to $1,000. 

By September 2022, there had been 368 breaches affecting 25.1 million patients, as per the U.S. Department of Health and Human Services Breach Portal. Out of these, 206 breaches began with the network server being compromised with malware, and 95 began with email phishing and privileged access abuse.

Healthcare firms are frequently the target of ransomware attacks for being heavily dependent on access to data such as patient records for their operations. A CISA advisory warned healthcare and hospital administrators of a newly discovered ransomware variant, Daixin Team, that infected and extorted healthcare and public health providers.

While ransom payment demands are the norm in ransomware attacks, cybercriminals have additional leverage on healthcare victims, as releasing medical information can violate state and federal laws on privacy and security regulations of medical records.

As prominent ransomware attackers get busted and shut down, newer groups may increase their attacks in 2023. Let’s do a bird’s eye view of the most prominent healthcare cyber attacks from 2022.

Ransomware is malware that gets installed on a computer, holding it hostage and asking for the user to pay a ransom to regain control of their machine. When ransomware infects a machine, the user cannot access any of their applications or data, and they lose control over the computer completely. A ransomware attack in a healthcare facility can render essential computational resources inept, risking the lives of patients.

Data breaches can take various forms, one of which is credential-stealing malware that captures the credentials of someone with access to other sensitive data. In this way, the attacker is able to steal and exploit other data they find within the system. 

Also, insiders may intentionally or unintentionally disclose patient data. Laptops or other devices that store protected health information (PHI) and personally identifiable information (PII) can be lost or stolen and get into the hands of data thieves.

A distributed denial-of-service (DDoS) attack is a popular tactic involving flooding a web server with fake requests. The server is programmed to respond to these requests, which consumes its resources. As a result, it cannot provide access and functionality to legitimate users. In addition to phishing, DDoS attacks are a popular technique used by hacktivists and cyber criminals to overwhelm a network to the point of inoperability.

Employees encompass a variety of vulnerabilities. Some may click on malicious links unknowingly and introduce malware into the system. Others may give away access codes that end up getting abused by attackers. Using multi-factor authentication (MFA) can cut down on insider threats because this requires multiple credentials before allowing someone access.

Business email compromise (BEC) scammers use spoofed email or compromised accounts to trick employees into initiating a money transfer to a fraudulent account. Because the email looks like it comes from a legitimate, trusted source, the scammer is able to get their target to drop their guard. Securing medical devices with new passwords after this kind of attack may be necessary to prevent a breach.