Healthcare Ransomware Attacks Have Almost Doubled

Healthcare Ransomware Attacks Have Almost Doubled


Directors Report: This Premium article is exclusive to Premium Subscribers. For unrestricted website access please Subscribe: £5 monthly / £50 annual.


Ransomware attacks against healthcare companies are increasing, leaving hospitals and other care facilities' data vulnerable to criminal hackers' demands. The increase in successful ransomware attacks is part of an increasingly challenging broader threat environment which has affected healthcare more than any other sector. 

Healthcare saw the highest increase in volume of cyber attacks (69%) as well as the complexity of cyber attacks (67%) compared to the cross-sector average of 57% and 59% respectively.  In terms of the impact of these cyber attacks, healthcare was the second most affected sector (59%) compared to the global average of 53%.

Almost two-thirds (66%) of healthcare organisations were hit by ransomware attacks last year, up from 34% in 2020, according to a new report from cyber security firm Sophos. The near-doubling of cyber incidents demonstrates how attackers have become “considerably more capable at executing the most significant attacks at scale,” says the report.

Because healthcare organisations are so heavily dependent on access to data, such as patient records, to maintain their operations, they are a frequent target for ransomware attacks. Even a short delay in access to records can result in negative outcomes for patients.

The ransomware business is lucrative for attackers who target healthcare:

  • 61% of organisations reported paying ransoms to get their stolen data back, up from the cross-industry average of 46%. 
  • On average, in 2021, healthcare organisations that paid the ransom got back only 65% of their data, down from 69% in 2020. 
  • Similarly, only 2% of those that paid the ransom in 2021 got all their data back, down from 8% in 2020. in parallel to restore data, highest of all sectors.

A full 61% of the healthcare organisations that reported ransomware attacks had their data encrypted during the event, according to the Sophos report, The State of Ransomware in Healthcare 2022. This was slightly better than the 65% encryption rate across all industry sectors worldwide, “indicating that healthcare was better able to stop data encryption in a ransomware attack,” Sophos said, noting that it also is an improvement from the 65% encryption rate in healthcare in 2020. The report's findings are based on an independent “vendor-agnostic” survey of 5,600 information technology professions in medium-sized organisations, including 381 healthcare respondents across 31 countries.

The report also showed an improvement in the rate of extortion-only attacks to just 4% in 2021, compared to 7% in 2020. In extortion-only attacks, the data is not encrypted but the healthcare organisation was “held to ransom with the threat of exposing data.” The improvement could be because more healthcare organisation have cyber insurance, “which demands higher cyber security defence enhancements.”

The increase in successful ransomware attacks has “affected healthcare more than any other sector,” according to Sophos, which is based in the United Kingdom. Healthcare had the “highest increase in volume of cyber-attacks (69%) as well as the complexity of cyber-attacks (67%)” when compared with cross-sector averages.

Improved Ransomware Outcomes

Almost all (99%) of healthcare organisations subject to ransomware attacks in 2021 got “some encrypted data back” compared with only 93% in 2020. Within this group, 72% were able to restore encrypted data from backup files; 61% also reported that they “paid the ransom to restore data”; and 33% used other means to restore data. 
These numbers show that “many healthcare organisations use multiple restoration approaches to maximise speed and efficacy” to restore data and operations. 

More than half of healthcare organisations (52%) reported using multiple restoration methods, according to Sophos.

Interestingly, 14% of healthcare organisations reported using “three methods in parallel” to restore their data, which was the highest rate across all sectors and double the global average. Healthcare is the sector most likely to pay the ransom, with 61% of respondents whose data was encrypted admitting to paying the ransom compared to the cross-sector average of 46%. This number is also almost double than the 34% who paid the ransom in 2020. 

The highest increase in the volume and complexity of attacks on healthcare as compared to all other sectors is a likely reason behind their high propensity to pay and overcome their limited preparedness in dealing with such attacks. 

Other reasons, as we will see later in this report, could be the impact of ransomware that affects not only the encrypted databases and devices but also the operations and business revenues of healthcare organisations, leaving them in a rush for normalcy. However, healthcare organisation that paid the ransom to restore their data got back only 65% of their data compared with 69% in 2020. Only 2% that paid the ransom received all of their data, down from 8% in 2020.

Cost of Ransomware Attacks

Although healthcare tops the list for payments, it is at the bottom for the amount paid with the “lowest average ransom payment” around $197,000 of all sectors. Although the amounts paid were lower than in other sectors, the “overall amount of ransom paid by healthcare in 2021” went up by 33% compared to 2020, according to Sophos.
Only three respondents said their organisation paid $1 million or more, according to the report. In contrast, 60% of the ransoms paid were less than $50,000. 

The lower amounts likely due to the “constrained finances” of healthcare organisation, especially those in the public sector, according to Sophos.

Paying the ransom, however, is not the only cost of a ransomware attack. Ninety-four percent of respondents said the ransomware attack impacted their ability to operate and 90% of private sector healthcare organisations responded that the attack “caused them to lose business or revenue.” In fact, the average cost for a healthcare organisation to remediate the impact of a ransomware attack went up to $1.85 million in 2021, compared to $1.27 million in 2020. This was the second-highest average cost across all sectors.

It took 44% of healthcare organisations “up to a week” to recover from a ransomware attack in 2021, and 25% took up to a month to recover. The average time for healthcare organisations to recover was one week.

Cyber Insurance

Only 78% of healthcare organisation reported having cyber-insurance against ransomware, with 46% also saying that here are “exclusions or exceptions in their policies.” Additionally, 93% of healthcare organisations with cyber-insurance reported it was getting harder to secure coverage with 34% saying it was also more expensive. Additionally, healthcare organisations reported the level of cyber security required to qualify for coverage was higher, policies are more complex, and fewer companies offer cyber-insurance.

Ransomware impacts healthcare operations, business, and revenue. Most healthcare organisations are choosing to reduce the financial risk associated with such attacks by taking cyber insurance. For them, it is reassuring to know that insurers pay some costs in almost all claims. However, it’s getting harder for organisations to secure coverage. This has driven almost all healthcare organisations to make changes to their cyber defences to improve their cyber insurance position. 

For healthcare organisations with cyber insurance coverage, 97% that were hit by ransomware and had ransomware coverage report that their policy paid out in the “most significant attack.” More than 80% reported the insurer paid the costs incurred to restore operations; however, only 47% reported that the insurer paid the ransom.
"In the face of this near-normalisation, healthcare organisations have gotten better at dealing with the aftermath of an attack: virtually everyone now gets some encrypted data back and nearly three quarters are able to use backups to restore data," said Sophos researchers in their report. "Most healthcare organisations are choosing to reduce the financial risk associated with such attacks by taking cyber insurance," they added. "For them, it is reassuring to know that insurers pay some costs in almost all claims... However, it’s getting harder for organisations to secure coverage. This has driven almost all healthcare organisations to make changes to their cyber defences to improve their cyber insurance position."

Sophos  Recommend Best Practices For Healthcare Organisations 

Review security controls regularly and make sure they continue to meet the organisation's needs.

  •  Install and maintain high-quality defences across all points in the organisation’s environment. 
  • Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines and open Remote Desktop Protocol ports. Extended Detection and Response (XDR) solutions are ideal for helping to close these gaps.
  • Make backups, and practice restoring from them so that the organisation can get back up and running as soon as possible, with minimum disruption.
  • Proactively hunt for threats to identify and stop adversaries before they can execute their attack. And if the team lacks the time or skills to do this in house, outsource to a Managed Detection and Response (MDR) specialist
  • Prepare for the worst. Know what to do if a cyber incident occurs and keep the plan updated

The most important thing for anyone in the healthcare field to understand should be that their organisation is extremely likely to suffer a ransomware attack very soon and they need a strategy and engaging tactics to deal with the problem.

References:

Thomson Reuters:   Thomson Reuters:     

Sophos:   HealthcareIT News:   

Tech.co    Interhospi

 HHMGlobal:     Integral Defence

 

« Twitter Concealed Known Security Flaws
Attackers Demand $10m Ransom From French Hospital »

Quartz Conference
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Spectra Logic

Spectra Logic

Spectra Logic develops data storage solutions that solve the problem of short and long-term digital preservation for business and technology professionals.

Secure Identity Alliance (SIA)

Secure Identity Alliance (SIA)

The Secure Identity Alliance is dedicated to supporting sustainable worldwide economic growth and prosperity through the development of trusted digital identities and the adoption of secure eServices.

Veracode

Veracode

Veracode delivers the most widely used cloud-based platform for securing web, mobile, legacy and third-party enterprise applications.

Site24x7

Site24x7

Site24x7 is an all-in-one performance monitoring solution for Networks, Websites, Servers and Applications.

Secure Thingz

Secure Thingz

Secure Thingz focus on developing and delivering advanced security solutions into the emerging Industrial Internet of Things (IIoT) and Critical Infrastructure markets.

PECB

PECB

PECB is a certification body for persons, management systems, and products on a wide range of international standards in a range of areas including Information Security and Risk Management.

Athreon

Athreon

Athreon utilizes a fusion of AI technology, human interpretation, and the latest in cybersecurity to deliver sound business solutions that help our clients make better data-driven decisions.

Drata

Drata

Drata is a security and compliance automation platform that continuously monitors and collects evidence of a company's security controls, while streamlining workflows to ensure audit-readiness.

Xperience

Xperience

Xperience solves our clients’ toughest challenges by delivering business efficiency through digital transformation solutions across cloud, managed IT, CRM and ERP.

Opora

Opora

Opora is the leading cybersecurity provider of adversary behavior analytics “ABA” and preemptive security solutions.

PlexTrac

PlexTrac

PlexTrac is a cybersecurity reporting and workflow management platform that supercharges security programs, making them more effective, efficient, and proactive.

RMRF Tech

RMRF Tech

RMRF is a team of cybersecurity engineers and penetration testers which specializes in the development of solutions for early cyber threat detection and prevention.

Xmirror Security

Xmirror Security

Xmirror Security focuses on integrated detection and defense of the continuous threat to the DevSecops software supply-chain with artificial intelligence technology as the core.

Nuts Technologies

Nuts Technologies

Nuts Technologies are simplifying data privacy and encryption with our innovative and novel data containers we call nuts based on our Zero Trust Data framework.

Cloudsec Asia

Cloudsec Asia

Cloudsec Asia is Thailand's top-ranked cybersecurity consultant company. We offers security services to ensure that all your IT assets are reliable, accessible, and secure.

Zokyo

Zokyo

Zokyo is a venture studio that builds, secures, and funds legendary web3/crypto businesses.