The Cybersecurity threats faced by the healthcare industry are not limited to stealing data, but increasingly to extorting healthcare organisations. Attackers are moving away from merely taking confidential data to now holding it as leverage to force organisations to pay a ransom. This continues to be a developing trend leading to the biggest threats to medical providers.
A good example of this is the Heart South Cardiovascular Group Data Breach, where a third party claims to hold sensitive personal health information of patients. Unlike traditional data breaches that are detected by the organisation after a third party has accessed and extracted data; for this incident it is external to the provider; however, the external party has claimed to already have accessed and extracted valuable information.
The highly confidential nature of this type of health-related data makes it very appealing to any type of extortion-based attack. Medical records typically contain personal and private information including but not limited to physical health status, medical treatment, basic identifying information and health history. When this data is stolen and or threatened to be stolen, there will be a magnitude of pressure placed on organisation(s) to take immediate action, which creates multiple layers of complications for the organization(s).
Why these attacks are particularly worrisome is that there's a psychological aspect to them. Cybercriminals attack not just the systems, but also the trust relationship between a healthcare provider and their patients by threatening to make their patients' private information public. The reputational damage of cyber incidents is extremely severe - even before any data has been leaked.
The incident at Heart South shows how much more aggressive attackers are becoming when they communicate directly with their victims. Rather than silently extracting information and selling it on the dark web, they are now openly telling the organizations they are targeting that they are doing so. This creates a greater sense of urgency and pressure organizations to quickly make decisions about how to contain, disclose, or deal with the legal consequences of the attack.
In addition, the impact on patients can be far-reaching. A single data breach at any specialized healthcare provider (in this case, cardiovascular care) can affect tens of thousands of patients; and the records of those types of patients will typically include a lifetime of medical history and details regarding their current treatment. Patients may suffer from many types of consequences once their private information is made public. Such consequences could include identity theft; insurance fraud; and privacy violation.
Healthcare organizations need to develop a dual-pronged approach to handling cyber attacks, which will include both data theft and data ransom. In order to adequately prepare for this dual threat, they will need more advanced measures than traditional cyber defenses; therefore, they must adopt additional cybersecurity measures such as endpoint detection, network segmentation, real-time monitoring, and incident response planning. Additionally, healthcare employees must be educated about security, as many attacks originate from either phishing or stolen access credentials.
Patients also need to remain vigilant, as well. Steps that patients can take to reduce their risk include monitoring their financial accounts for suspicious activity, reviewing medical statements for accuracy, and being cautious when receiving unexpected communication from a healthcare provider, and while they may not have control over how an organization secures their data, they can take proactive action to protect themselves from becoming victims following a cyber breach.
Cyber threats to healthcare organizations will continue to evolve; therefore, healthcare organizations need to understand that the foundation of a trusting relationship between a healthcare provider and its patients includes the secure storage and protection of private medical records. As evidenced by the Heart South Data Breach, the potential threat to patients due to cyber incidents will continue to be significant; therefore, securing private medical records must go beyond just a technical obligation of the organization and be recognized as an essential component of providing safe and secure delivery of healthcare in an increasingly digital world.
