Instances of hacking have always been a major problem for healthcare cybersecurity. This industry deals with incredibly sensitive data, ranging from personally identifiable information to health files that could be used to blackmail a patient. Therefore, it makes sense that cybercriminals would target this sector in order to steal valuable records.
However, a recent trend has shown that hackers don’t need to implement a theft in order to get money from these institutions. Ransomware is a relatively new hacking technique that basically involves encrypting the victim’s data and forcing them to pay a fee in order to unlock it. This is a huge problem for medical facilities such as hospitals, as cybercriminals have begun to increasingly victimize them.
This threat is a major issue in the current cybersecurity landscape, and health care administrators must make preparations for it.
Attacks are increasing
“During only the first half of 2016, around 79 new ransomware families were created.”
Overall, ransomware development is increasing at an alarming rate. A study conducted by security firm Trend Micro found that during the entirety of 2015, around 29 new variants of ransomware were made. However, during only the first half of 2016, about 79 new families were created. This massive uptick in malware formulation is a direct result of the success these kinds of infections are generating, especially within health care.
Medical organizations all over the world have been hit by ransomware. Kansas Heart Hospital became the victim of such an attack earlier this year, according to Healthcare IT News. The facility eventually decided to pay the ransom. Sadly, as is the case with many organizations caught in these kinds of situations, the hackers received the money and only demanded more.
What’s more, this isn’t an isolated incident. According to cybersecurity researchers at FireEye, a recent ransomware campaign focused mainly on organizations within the medical field. More than half of the institutions that fell prey to this attack were under the health care umbrella.
Why hit medical organizations?
Clearly, a lot of hackers have decided that health care organizations are prized victims when they dream up ransomware schemes. That said, the question remains as to why these institutions are the ones falling under the cross hairs of cybercriminals. A basic answer here can be broken down into three parts.
First, and perhaps most important, is the fact that most health care facilities cannot operate without access to medical information and IT systems. Properly diagnosing and treating patients requires a lot of data, and not being able to view this information causes a huge slowdown. What’s more, hackers know that this will cause a major panic, as patients with more serious cases could be plunged into a life-threatening situation. Many institutions will simply pay the ransom just to save lives.
Doctors need information to help patients.Second, outside pressure can also force hospitals to pay. The sad reality of the situation is that a lot of people don’t fully understand how different kinds of cyberattacks work. An organization can do everything in its power to assure patients that their data has been encrypted but not stolen, and many people still would cause an uproar. Quickly dealing with the situation before it becomes public knowledge is often seen as a better solution.
Third, hospitals are filled with overworked employees. Professionals in this field work long hours, which is certainly appreciated by the patients but also means that they miss out on sleep and are generally stressed out. This means that they might accidentally click on a link in an email that they otherwise would have ignored, allowing for a widespread infection.
A solution needs to come from multiple places
With such a complex problem, it can be hard to create a “silver bullet solution.” Therefore, it’s important for health care facility administrators to come up with a multi-faceted plan to mitigate the risks of a ransomware infection and increase healthcare cybersecurity. This is the only way to help ensure an organization isn’t caught unprepared.
Of course, this begins with employees. A majority of ransomware cases begin through email campaigns directed toward staff members, and it is extremely important that these people get educated as to the threats that currently face them. They should be able to spot obvious phishing signs, such as spelling errors and a clear misuse of proper grammar.
Another great way to avoid this problem altogether is to move away from email as much as possible. A hosted fax server like fax over IP solutions allow employees to send information in an incredibly secure environment without having to worry about a hacker intercepting the data. On top of this, cybercriminals don’t focus on FoIP like they do with email, which means institutions utilizing this service can sidestep any sort of ransomware campaign.
Enhance enterprise communication, collaboration and compliance efforts with a proven FoIP solution from FaxCore. Contact FaxCore today to learn more about their ‘Partly-Cloudy’ fax solutions and how you can prevent cyber-attacks in healthcare.
