Expert discusses what makes the healthcare industry a popular attack vector and how organizations could improve their cybersecurity
Yesterday, the US Federal Bureau of Investigation, Departments of Homeland Security, and Health and Human Services issued a joint alert warning of an “imminent” increase in ransomware and other cyberattacks against the U.S. healthcare and public health sector.
According to the official statement, the federal agencies have “credible information” that cybercriminals are increasingly targeting hospitals and healthcare providers with a wave of data-scrambling extortion attacks that produce “data theft and disruption of healthcare services.”
“Having to work with the good old pen and paper after medical staff gets locked out of the system is one thing, but when they can’t access important medical data like information about critical care patients, the situation becomes a matter of life and death,” warns Oliver Noble, a data encryption specialist at NordLocker. Just a month ago, the police in Germany launched an investigation after a woman died as a result of being transferred to another hospital following a ransomware attack.
So, why is healthcare such an appealing target for cybercriminals? What measures can healthcare providers take to protect patients’ data?
What makes healthcare so attractive to hackers?
Healthcare institutions are a potential gold mine for cybercriminals, as they get to take hold of an overwhelming amount of the most sensitive data. “Besides intimate medical data nobody wants to have exposed, hackers can get their hands on other private information, such as patients’ home addresses, social security numbers, and banking information. If stolen, this data can end up in financial or identity theft scams,” says Oliver Noble.
Unlike in other sectors, for example, retail, the information stolen in attacks against healthcare cannot be changed upon the detection of the breach. “You can always get a new credit card or change your leaked passwords, but your DNA is for life,” the expert emphasizes.
According to Oliver Noble, healthcare organizations make for an ideal prey for hackers, as many use outdated security software and continue to underinvest in cybersecurity. The healthcare industry invests only 4% to 7% of revenue in digital security initiatives. In comparison, the financial sector spends 15% of its revenue on cybersecurity. This is keeping in mind that, to the private healthcare sector, leaks of personal data might mean huge fines and even criminal charges for HIPPA violations due to negligence.
All of the reasons above provide hackers with a good chance of having their ransom demands fulfilled. To avoid a bad reputation and even legal repercussions, healthcare institutions must make cybersecurity their top priority.
What practical measures can healthcare organizations take to protect themselves?
According to Oliver Noble, to prevent various failures of compliance, healthcare companies should implement the following:
- Adopt zero-trust network access, meaning that every access request by a member of medical staff should be granted only after their identity has been appropriately verified.
- Encrypt medical files to avoid data leaks in ransomware. Business encryption solutions like NordLocker make sure important information stored on corporate computers is always protected from prying eyes with strong encryption. The tool also offers an encrypted cloud for easy access and secured data storage.
- Have up-to-date backups available to keep the chances of data loss as slim as possible. If an attack is successful, there will still be an unaffected older version of the files. Again, a cloud solution for companies is a great way to back up data.
- Educate employees on cybersecurity. Since ransomware attacks usually start with a phishing email, awareness and education will help employees recognize phishing scams and avoid downloading malware or sharing sensitive information with impersonators.
- Use a VPN for a safe internet connection. To avoid outside risks, employees need a secure connection, and here’s where a VPN (Virtual Private Network) comes into play. It creates a secure encrypted tunnel between an employee’s device and the internet or the company’s server. A VPN protects the connection from third-party access, including hackers ready to breach the system.
ABOUT NORDLOCKER
NordLocker is the world’s first end-to-end file encryption tool with a private cloud. It was created by the cybersecurity experts behind NordVPN – one of the most advanced VPN service providers in the world. NordLocker is available for Windows and macOS, it supports all file types, offers a fast and intuitive interface, and guarantees secure sync between devices. With NordLocker, files are protected from hacking, surveillance, and data collection. For more information: nordlocker.com.
