Tech Support
Documentation
Login
Contact Us
Ransomware, Data Breaches and Data Theft – The CyberSecurity Diseases Infecting HealthCare Organizations
Joao Correia
June 19, 2023 - Technical Evangelist
Healthcare institutions today are under increasing threat from cyberattacks, with ransomware, data breaches, and data theft becoming more prevalent. The complexity of healthcare infrastructures, connecting patients, doctors, clinical exams, diagnostic equipment, and scheduling, makes them particularly vulnerable to these threats. Compliance requirements add to the challenge, making it difficult for healthcare institutions to maintain secure systems in such high risk environments.
In recent years, there have been several notable examples of breaches within the healthcare sector. One of the most recent, and significant, was a ransomware attack on Managed Care of North America (MCNA) Dental, one of America’s largest dental health insurers. This breach compromised the personal information of almost nine million individuals in the United States, making it the largest health information breach of 2023 (so far). The LockBit ransomware group claimed responsibility for the attack and claimed to have stolen 700GB of data after the company refused to pay a $10 million ransom demand.
PharMerica, one of the largest pharmacy service providers in the United States, also faced a significant data breach. Hackers accessed the personal data of nearly six million patients, including names, dates of birth, Social Security numbers, medication, and health insurance information. The Money Message ransomware gang claimed credit for the cyberattack and published the stolen data on a dark web leak site.
In Europe, French company Dedalus Biologie was fined 1.5 million euros after a data breach resulted in the exposure of medical information of nearly 500,000 people. The breach occurred during a software migration, where Dedalus Biologie extracted more data than required and failed to ensure the security of the personal data.
These incidents highlight the vulnerability of healthcare institutions to cyber threats. Hacking and IT incidents account for just over half of the 40 data breaches reported in January 2023 in the US alone, many of which involved hacked network servers. The records of 698,295 individuals were exposed or stolen in these 23 hacking incidents.
Addressing these risks requires robust security measures and continuous monitoring of systems. Encryption of personal data, automatic deletion of data after migration, and authentication requirements are just a few of the security measures that institutions need to implement. Timely patching of vulnerabilities should get increased attention, as unpatched vulnerabilities remain as one the preferred attack vectors for threat actors. Furthermore, organizations need to ensure that they process data in compliance with relevant regulations and that they only extract data when necessary during operations like software migrations.
The threat of ransomware, data breaches, and data theft to healthcare institutions is growing, and these organizations need to take appropriate steps to protect their data and ensure the privacy and security of their patients. Failure to do so not only exposes sensitive patient information but also leads to heavy fines and reputational damage.
