Healthcare Ransomware Attacks Have Almost Doubled

Healthcare Ransomware Attacks Have Almost Doubled


Directors Report: This Premium article is exclusive to Premium Subscribers. For unrestricted website access please Subscribe: £5 monthly / £50 annual.


Ransomware attacks against healthcare companies are increasing, leaving hospitals and other care facilities' data vulnerable to criminal hackers' demands. The increase in successful ransomware attacks is part of an increasingly challenging broader threat environment which has affected healthcare more than any other sector. 

Healthcare saw the highest increase in volume of cyber attacks (69%) as well as the complexity of cyber attacks (67%) compared to the cross-sector average of 57% and 59% respectively.  In terms of the impact of these cyber attacks, healthcare was the second most affected sector (59%) compared to the global average of 53%.

Almost two-thirds (66%) of healthcare organisations were hit by ransomware attacks last year, up from 34% in 2020, according to a new report from cyber security firm Sophos. The near-doubling of cyber incidents demonstrates how attackers have become “considerably more capable at executing the most significant attacks at scale,” says the report.

Because healthcare organisations are so heavily dependent on access to data, such as patient records, to maintain their operations, they are a frequent target for ransomware attacks. Even a short delay in access to records can result in negative outcomes for patients.

The ransomware business is lucrative for attackers who target healthcare:

  • 61% of organisations reported paying ransoms to get their stolen data back, up from the cross-industry average of 46%. 
  • On average, in 2021, healthcare organisations that paid the ransom got back only 65% of their data, down from 69% in 2020. 
  • Similarly, only 2% of those that paid the ransom in 2021 got all their data back, down from 8% in 2020. in parallel to restore data, highest of all sectors.

A full 61% of the healthcare organisations that reported ransomware attacks had their data encrypted during the event, according to the Sophos report, The State of Ransomware in Healthcare 2022. This was slightly better than the 65% encryption rate across all industry sectors worldwide, “indicating that healthcare was better able to stop data encryption in a ransomware attack,” Sophos said, noting that it also is an improvement from the 65% encryption rate in healthcare in 2020. The report's findings are based on an independent “vendor-agnostic” survey of 5,600 information technology professions in medium-sized organisations, including 381 healthcare respondents across 31 countries.

The report also showed an improvement in the rate of extortion-only attacks to just 4% in 2021, compared to 7% in 2020. In extortion-only attacks, the data is not encrypted but the healthcare organisation was “held to ransom with the threat of exposing data.” The improvement could be because more healthcare organisation have cyber insurance, “which demands higher cyber security defence enhancements.”

The increase in successful ransomware attacks has “affected healthcare more than any other sector,” according to Sophos, which is based in the United Kingdom. Healthcare had the “highest increase in volume of cyber-attacks (69%) as well as the complexity of cyber-attacks (67%)” when compared with cross-sector averages.

Improved Ransomware Outcomes

Almost all (99%) of healthcare organisations subject to ransomware attacks in 2021 got “some encrypted data back” compared with only 93% in 2020. Within this group, 72% were able to restore encrypted data from backup files; 61% also reported that they “paid the ransom to restore data”; and 33% used other means to restore data. 
These numbers show that “many healthcare organisations use multiple restoration approaches to maximise speed and efficacy” to restore data and operations. 

More than half of healthcare organisations (52%) reported using multiple restoration methods, according to Sophos.

Interestingly, 14% of healthcare organisations reported using “three methods in parallel” to restore their data, which was the highest rate across all sectors and double the global average. Healthcare is the sector most likely to pay the ransom, with 61% of respondents whose data was encrypted admitting to paying the ransom compared to the cross-sector average of 46%. This number is also almost double than the 34% who paid the ransom in 2020. 

The highest increase in the volume and complexity of attacks on healthcare as compared to all other sectors is a likely reason behind their high propensity to pay and overcome their limited preparedness in dealing with such attacks. 

Other reasons, as we will see later in this report, could be the impact of ransomware that affects not only the encrypted databases and devices but also the operations and business revenues of healthcare organisations, leaving them in a rush for normalcy. However, healthcare organisation that paid the ransom to restore their data got back only 65% of their data compared with 69% in 2020. Only 2% that paid the ransom received all of their data, down from 8% in 2020.

Cost of Ransomware Attacks

Although healthcare tops the list for payments, it is at the bottom for the amount paid with the “lowest average ransom payment” around $197,000 of all sectors. Although the amounts paid were lower than in other sectors, the “overall amount of ransom paid by healthcare in 2021” went up by 33% compared to 2020, according to Sophos.
Only three respondents said their organisation paid $1 million or more, according to the report. In contrast, 60% of the ransoms paid were less than $50,000. 

The lower amounts likely due to the “constrained finances” of healthcare organisation, especially those in the public sector, according to Sophos.

Paying the ransom, however, is not the only cost of a ransomware attack. Ninety-four percent of respondents said the ransomware attack impacted their ability to operate and 90% of private sector healthcare organisations responded that the attack “caused them to lose business or revenue.” In fact, the average cost for a healthcare organisation to remediate the impact of a ransomware attack went up to $1.85 million in 2021, compared to $1.27 million in 2020. This was the second-highest average cost across all sectors.

It took 44% of healthcare organisations “up to a week” to recover from a ransomware attack in 2021, and 25% took up to a month to recover. The average time for healthcare organisations to recover was one week.

Cyber Insurance

Only 78% of healthcare organisation reported having cyber-insurance against ransomware, with 46% also saying that here are “exclusions or exceptions in their policies.” Additionally, 93% of healthcare organisations with cyber-insurance reported it was getting harder to secure coverage with 34% saying it was also more expensive. Additionally, healthcare organisations reported the level of cyber security required to qualify for coverage was higher, policies are more complex, and fewer companies offer cyber-insurance.

Ransomware impacts healthcare operations, business, and revenue. Most healthcare organisations are choosing to reduce the financial risk associated with such attacks by taking cyber insurance. For them, it is reassuring to know that insurers pay some costs in almost all claims. However, it’s getting harder for organisations to secure coverage. This has driven almost all healthcare organisations to make changes to their cyber defences to improve their cyber insurance position. 

For healthcare organisations with cyber insurance coverage, 97% that were hit by ransomware and had ransomware coverage report that their policy paid out in the “most significant attack.” More than 80% reported the insurer paid the costs incurred to restore operations; however, only 47% reported that the insurer paid the ransom.
"In the face of this near-normalisation, healthcare organisations have gotten better at dealing with the aftermath of an attack: virtually everyone now gets some encrypted data back and nearly three quarters are able to use backups to restore data," said Sophos researchers in their report. "Most healthcare organisations are choosing to reduce the financial risk associated with such attacks by taking cyber insurance," they added. "For them, it is reassuring to know that insurers pay some costs in almost all claims... However, it’s getting harder for organisations to secure coverage. This has driven almost all healthcare organisations to make changes to their cyber defences to improve their cyber insurance position."

Sophos  Recommend Best Practices For Healthcare Organisations 

Review security controls regularly and make sure they continue to meet the organisation's needs.

  •  Install and maintain high-quality defences across all points in the organisation’s environment. 
  • Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines and open Remote Desktop Protocol ports. Extended Detection and Response (XDR) solutions are ideal for helping to close these gaps.
  • Make backups, and practice restoring from them so that the organisation can get back up and running as soon as possible, with minimum disruption.
  • Proactively hunt for threats to identify and stop adversaries before they can execute their attack. And if the team lacks the time or skills to do this in house, outsource to a Managed Detection and Response (MDR) specialist
  • Prepare for the worst. Know what to do if a cyber incident occurs and keep the plan updated

The most important thing for anyone in the healthcare field to understand should be that their organisation is extremely likely to suffer a ransomware attack very soon and they need a strategy and engaging tactics to deal with the problem.

References:

Thomson Reuters:   Thomson Reuters:     

Sophos:   HealthcareIT News:   

Tech.co    Interhospi

 HHMGlobal:     Integral Defence

 

« Twitter Concealed Known Security Flaws
Attackers Demand $10m Ransom From French Hospital »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

it-sa 365

it-sa 365

it-sa 365 is a digital platform for connecting IT security vendors and experts with those who bear responsibility for IT security in management and technology.

Allen & Overy

Allen & Overy

Allen & Overy is an international law firm. Practice areas include Cybersecurity and Data Protection.

Grid32

Grid32

Grid32 provide penetration testing, vulnerability assessments, software code audits, training and incident response services.

MetaFlows

MetaFlows

MetaFlows’ SaaS malware detection & prevention software passively analyzes the behavior and the content of Internet traffic.

STMicroelectronics

STMicroelectronics

ST is a global semiconductor leader delivering intelligent and energy-efficient products and solutions that power the electronics at the heart of everyday life.

CERT-PY

CERT-PY

CERT-PY is the national Computer Emergency Response Team for Paraguay.

Paygilant

Paygilant

Paygilant’s disruptive technology is designed to protect mobile payment  financial transactions against fraudulent attacks, whether executed by NFC, QR code, P2P or in-app.

Seric Systems

Seric Systems

Seric is a technology business specialising in security, infrastructure and data management.

Cyber Observer

Cyber Observer

Cyber Observer’s team specializes in providing corporate officers with comprehensive, visual, real-time performance overview, critical security control (CSC) analysis.

Scanmeter

Scanmeter

Scanmeter helps identifying vulnerabilities in software and systems before they can be exploited by an attacker.

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

Document Security Systems (DSS)

Document Security Systems (DSS)

DSS anti-counterfeit, authentication, and brand protection solutions are deployed to prevent attacks which threaten products, digital presence, financial instruments, and identification.

DDLS

DDLS

DDLS is Australia's largest provider of corporate IT, process training and cybersecurity training courses and certification programs.

Hassans International Law Firm

Hassans International Law Firm

Hassans is the largest law firm in Gibraltar, providing a full range of legal services across corporate and commercial law including Data Protection and GDPR compliance.

Talion

Talion

Talion aim to reduce the complexity involved in securing your organisation and to give security teams unrivalled visibility into their security operations, so they can make optimal decisions, fast.

Schillings

Schillings

Shillings defends your rights to privacy, reuptation and security. We fight passionately against breaches of your privacy, attacks on your reputation and threats to your security.