Healthcare Is The Prize Target For Cyber Criminals

At least three global issues will be remembered as characterising 2020. The Coronavirus, climate change and the increased use of the Internet by criminals to disrupt society. Two of these issues have now merged as cyber attacks are being used to disrupt health care organisation as they fight the virus pandemic

As the healthcare sector continues to offer life-critical services while working to improve treatment and patient care with new technologies, criminals and cyber threat actors look to exploit the vulnerabilities that are coupled with these changes. More than a quarter of the incidents which the UK's National Cyber Security Centre (NCSC) responded to were in 2020 related to the Coronavirus. 

From a criminal view point the reason is that confidential patient information is worth a lot of money to hackers when put up for sale on the Dark Net. 

Hospitals store an incredible amount of patient data. Confidential data that’s worth a lot of money to hackers who can sell it on easily – making the industry a growing target. These organisations have a duty to protect their patients’ personal records. With GDPR coming into play this year, it’s becoming increasingly important for hospitals to keep their information secure.
Information exposed in the incident included names, dates of birth, health insurance information, medical treatment information, medical diagnostic information, lab results and medical record numbers. 

In the US, the Medicare or Medicaid healthcare programs hold medical billing information, bank account information, credit or debit card information, CHAMPUS ID numbers, Military and/or Veterans Administration numbers, driver’s license numbers, signatures, and Social Security numbers. 

According the NCSC, some of the incidents they deals with were related to countering nation-state attacks, but most were criminal in nature. It also disclosed that it had thwarted 15,354 campaigns that had used coronavirus themes as a "lure" to fool people into clicking on a link or opening an attachment containing malicious software.

Coronavirus has thrown the healthcare  sector to the forefront of cyber security in 2020, but the next year is likely to see the dangers continue and evolve. 

Threats from nation states and criminals to the health system are a growing concern. The huge logistical challenge of rolling out vaccines faces the risk of disruption to complex supply chains and criminal ransomware poses a threat at a time when the pandemic has increased our reliance on technology. The distribution of the various coronavirus vaccines may bring relief, but it also brings with it a major challenge for those involved who  have not previously had to think about cyber security.

The complex global supply chain for vaccines ranges from factories in one country to Internet-connected fridges in another. 
It will create new pressure on doctors' surgeries, IT systems, and sometimes small providers who play a critical role. 

IBM has already said it has said that the international vaccine supply chain has been targeted by cyber espionage .
says it believes the campaign started in September 2020 when phishing emails targeted organisations linked to the Cold Chain Equipment Optimisation Platform (CCEOP) of Gavi, the international vaccine alliance.

Major pharmaceutical companies are no stranger to cyber-espionage. In July, the UK accused Russian intelligence of targeting research, including for the Oxford vaccine, while the US accused Chinese hackers of similar activity. But despite concerns about states, experts say, criminal ransomware, the locking of people out of their computers and data until they pay a ransom remains a serious and persistent threat. 

A recent report from security firm Positive Technologies says half of all the cyber attacks on healthcare were ransomware in the July-to-September quarter of 2020. US hospitals have been worse hit than the UK. It is thought this is because criminals see them as richer than their NHS counterparts. In just 24 hours in October, five American hospitals received ransom demands of at least $1m (£810,000), leading to some cancer treatments being cancelled.

The UK has made stride to fix weaknesses in the NHS systems exposed by 2017's Wannacry ransomware attack. Even so, there are concerns it could be hit again. Any cyber security measures placed on healthcare organisations need to consider the impact they may have on current working practices.

IT staff should try to align security measures with existing software. There are plenty of authentication solutions available that work seamlessly with software like Office 365, meaning medical staff can perform their daily tasks without distraction.

Back Data Regularly

It doesn’t matter what industry you work in, backing up data should be a habit. You want to save any sensitive data and documents in at least one other location. It can be physical or virtual, like a hard drive or cloud system, but the key is to store information in separate, secure places.

Being the victim of a healthcare cyber attack can be devastating, but with a backup, you’ll be able to recover lost data and patient records much quicker. Otherwise, the hacking attempt might have a crippling effect on your organisation.

 Microsoft:      Infosecurity Magazine:   Swivel Secure:    BBC:     BBC:    NCSC:   

Health Tech Zone:      Center for Internet Security

You Might Also Read:

A Hospital Hack Caused A Patient To Die:

 

« Swatters Hack Smart Devices
Fallout From The SolarWinds Breach Widens »

Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

WEBINAR: How To Build A Security Observability Strategy In AWS

WEBINAR: How To Build A Security Observability Strategy In AWS

Thursday, Apr 22, 2021 - Join this webinar to learn how to build a security observability strategy in AWS, covering cloud-native monitoring sources, guardrails, and automation capabilities.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

eBook: Practical Guide to Security in the AWS Cloud

eBook: Practical Guide to Security in the AWS Cloud

AWS Marketplace would like to present you with a digital copy of the new book, Practical Guide to Security in the AWS Cloud, by the SANS Institute.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Huawei

Huawei

Huawei is a leading global ICT solutions provider. with end-to-end capabilities across the carrier networks, enterprise, consumer, and cloud computing fields.

Plan B

Plan B

Plan B is a specialist IT continuity and Disaster Recovery Service provider.

Certification Europe

Certification Europe

Certification Europe is an accredited certification body which provides ISO management system certification including ISO 27001.

Inavate Consulting

Inavate Consulting

Inavate Consulting are experts in defining and implementing information assurance solutions and governance frameworks. Our ISO27001 consultants are the most experienced in the industry.

SWAT Systems

SWAT Systems

SWAT Systems is an IT support and cyber security managed service provider.

Deepwatch

Deepwatch

deepwatch’s cloud SecOps platform and relentless customer focus are redefining the managed security services industry.

Cybermerc

Cybermerc

Cybermerc's services, training programmes and cyber security solutions are designed to forge collaborations across industry, government and academia, for collective defence of our digital borders.

CIBR Warriors

CIBR Warriors

CIBR Warriors are a leading cyber security and networking staffing company that provides workforce solutions with businesses nationwide in the USA.