What Can The Healthcare Sector Learn From 2021’s Threat Landscape?

According to a recent study, approximately 30% of the world’s data is currently being generated by the healthcare sector. By 2025, it’s expected that the compound annual growth rate of collected data for healthcare will reach an all-time high of 36%. That means the sector is generating data faster than manufacturing, entertainment, and even financial services. 

As the link between technology and healthcare continues to grow, supercharged by the fallout from the pandemic and the move to digitize everything from appointments and prescriptions to scans and blood tests, it’s little wonder the sector has become a prime target for cybercriminals.

Healthcare institutions have been heavily and repeatedly attacked by organized cybercriminals since the beginning of the pandemic, with hospitals, research facilities and pharmaceutical companies all being targeted due to the high-value, time-sensitive nature of their work. Over the past year we’ve seen a variety of attacks on this sector including:  ransomware, botnets, remote code execution and even DDoS attacks. These threats have been known for some time, with the FBI issuing a notice in 2020, warning organizations in healthcare about increasingly serious DDoS attempts. 

In our 2022 Security Report, we revealed that healthcare experienced an average of 830 cyberattacks every week throughout 2021, a staggering 71% increase on the previous year. This makes it one of the most heavily targeted industries in the world, ahead of utilities, banking and manufacturing. As the sector continues to experiment with IoT solutions - from wearable biometric scanners and automated prescriptions, to MRI machines that act as a welcome mat for hackers - its attack surface area is expanding faster than its security can keep up with.  

A Pandemic Of Cybercrime

As COVID-19 cases spiked around the world, so did attacks on our hardworking healthcare industry. In October 2021, the healthcare system that serves Newfoundland and Labrador in Canada was hit by a devastating ransomware attack that one local expert said was the “worst cyberattack in Canadian history.” Employee and patient data was stolen and thousands of vital appointments, including chemotherapy sessions, were canceled or delayed. In the same month, a crushing ransomware attack was directed at a hospital in the Middle East for the first time, as the Chinese group “DeepBlueMagic” targeted the Hillel Yaffe Medical Center in Israel. The medical center's computers were incapacitated, making the admission and discharge of patients virtually impossible. At the end of the year, the Behavioral Health Group (BHG), which runs more than 80 opioid clinics in the US, fell victim to a cyberattack that disrupted its entire network for more than a week. Prescriptions couldn’t be retrieved, so patients had to go without potentially life-saving medication. While BHG didn't reveal the cause of the incident, most experts agree it was likely a ransomware attack. 

More recently, in January 2022, a serious data breach at The Red Cross led to the exposure of half a million vulnerable people’s data. The organization, headquartered in Switzerland, had to shut down computer systems running its Restoring Family Links program, which seeks to reunite families during disasters or periods of conflict. 

What’s InIt For Hackers And Why Now?

The main motivation for threat actors targeting the healthcare sector, from hospitals and clinics to research facilities and charity organizations, appears to be financial. The sheer pressure that hospitals have been under over the past two years to help us deal with - and recover from - the pandemic, has been enormous. The more important the sector’s work, the more tempting the target becomes for threat actors. In June 2020, just months into the pandemic, the University of California’s School of Medicine was targeted and sensitive data was held to ransom, forcing the university to pay more than $1 million USD to carry on its important research. 

The health sector has always been vulnerable to extortion, but the pandemic increased this vulnerability tenfold. In 2020, Check Point Research revealed that the notorious Ryuk ransomware, which had been around since 2018, had changed its focus to specifically target hospitals in order to take advantage of the crisis. 

What Can The Health Sector Learn And How Should It Adapt?

In the vast majority of ransomware cases, the threat isn’t the ransomware itself, but its point of entry onto an organization’s network. Most are deployed through trojan infections, often occurring weeks or even months before an attack even takes place, so it's important that hospitals, clinics and research facilities have anti-ransomware solutions in place. 

The health sector also faces a unique challenge in that it has one of the fastest-growing attack surfaces of any industry. From infusion pumps and patient monitors in hospitals, to take-home biometric devices and even connected wheelchairs, the potential points of entry for threat actors are multiplying year on year. Hospitals and other healthcare environments should therefore be thinking about how to minimize this potential attack surface and reduce risk. The first step toward achieving this is gaining full visibility over every connected device or endpoint, then assigning a risk weighting to each device or category of devices before setting granular security policies that reflect the level of risk. 

At a time when the health sector is at its most vulnerable, it should also be at its most secure. By investing in proactive threat monitoring and detection solutions, clinics, hospitals and research facilities will be able to guard against the rising tide of targeted attacks, giving themselves a clean bill of health for 2022 and beyond. 

Ian Porteous is Regional Director, Security Engineering, UK&I at Check Point Software  

You Might Also Read: 

Inventive Ransomware Group Focused On Healthcare Data:

 

« EU & US Agree New Data Rules To Replace Privacy Shield
Types Of Security Testing Explained With Examples »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Civica

Civica

Civica provides cloud-based managed IT services, hosting and outsourcing.

Cryptomathic

Cryptomathic

Cryptomathic is an expert on commercial crypto - we develop, deliver and support the most secure and efficient off-the-shelf and customised solutions.

AFCERT

AFCERT

AFCERT is the national Computer Emergency Response Team for Afghanistan.

Huntsman Security

Huntsman Security

Huntsman Security provides technology to enable real-time security monitoring and immediate visibility of advanced threats and compliance issues.

Harel Mallac Technologies

Harel Mallac Technologies

Harel Mallac Technologies is a Mauritian organisation that has developed a strong network of ICT specialists with nodes across the African continent.

BetaDen

BetaDen

BetaDen provides a revolutionary platform for businesses to develop next-generation technology, such as the internet of things and industry 4.0.

LeadingIT

LeadingIT

Leading IT provides IT support, cloud computing, email support, cybersecurity, networking and firewall services to Chicagoland businesses.

Cyber Readiness Institute (CRI)

Cyber Readiness Institute (CRI)

At the Cyber Readiness Institute, our mission is simple: empower small and medium-sized enterprises with free tools and resources to help them become more secure and resilient.

Mandiant

Mandiant

Mandiant deliver dynamic cyber defense solutions powered by industry-leading expertise, intelligence and innovative technology.

Defentry

Defentry

Defentry have created an Ecosystem that lets our users easily monitor, train and resolve their digital security issues.

Krista Software

Krista Software

Krista is an intelligent automation platform that combines iPaaS and Conversational AI to automate complete business processes across your teams and apps.

CampusGuard

CampusGuard

CampusGuard focuses on the cybersecurity and compliance needs of campus-based organizations including higher education, healthcare, and state and local government.

Karate Labs

Karate Labs

Karate is an open-source unified test automation platform combining API testing, API performance testing, API mocks & UI testing.

Blackwell Security

Blackwell Security

Blackwell is a driving force in healthcare cybersecurity, transforming how security operations are conducted within this critical sector.

SGS Brightsight

SGS Brightsight

SGS Brightsight is the largest independent security evaluation lab in the world, with ten recognised labs worldwide.

Transcendental Technologies

Transcendental Technologies

Transcendental is a consulting organization which specializes in customized assurance services in the fields of Localization, Mobile Software Solutions, Web Design, Cyber Security & Cyber Forensics.