Hospitals Under Siege: Ransomware Attacks And Data Security

Ransomware attacks on hospitals have become an increasingly prominent issue, with hospitals and healthcare organizations facing more than 200 attacks in the first half of 2023 alone. These cyberattacks are often perpetrated by organized criminal gangs, terrorists, foreign governments, and military units, who exploit vulnerabilities in hospital computer systems to encrypt critical files and demand ransoms for their release. The impact of these attacks extends beyond financial costs, as they disrupt patient care, expose patient data, and increase the risk of mortality for admitted patients. The frequency and severity of ransomware attacks have highlighted the need for enhanced cybersecurity measures and policies to protect hospitals and patient safety effectively.

Phishing emails

During the early days of the COVID-19 pandemic, there was a notable increase in phishing email campaigns targeting the healthcare sector. These emails preyed on the fears and uncertainties surrounding the pandemic, often promising valuable resources that were in high demand, such as personal protective equipment (PPE) or ventilators. By disguising themselves as trustworthy sources, the attackers lured unsuspecting victims into clicking on malicious links or downloading malware-infected files.

One example of a successful phishing email campaign resulted in a ransomware attack on Brno University Hospital in the Czech Republic. The hospital, which was one of the country's largest coronavirus testing centers, was forced to redirect patients to other facilities due to the attack. This incident highlights the severe consequences of phishing emails, which can directly impact patient care and put lives at risk.

To protect against phishing emails, it is crucial to exercise caution when receiving unsolicited messages. It is recommended not to click on links or download files or attachments in emails, especially from unknown senders. Instead, it is advisable to go directly to the website of the company or organization and verify the authenticity of the communication. Advanced phishing filters, regular cybersecurity training for employees, and mock drills can also help safeguard against these threats.

Additionally, it is important to be wary of emails that instruct you to download or fill out specific forms or provide sensitive information. By copying suspicious email text into a search engine, you can often determine if it is part of a known phishing campaign. These simple precautions can help prevent ransomware attacks and protect both patient information and the ability of hospitals to provide critical care.

Criminal gangs and foreign governments

Criminal gangs have been responsible for a significant number of ransomware attacks on hospitals. These gangs have been in operation for decades but have become increasingly sophisticated in their tactics. They often model their operations after legitimate businesses, with websites, customer service lines, and even training for new members. Smaller gangs have also begun uniting to form larger organizations, offering their services to anyone wishing to carry out a ransomware attack. The ransom demands from these attacks can range from $100,000 to $5 million. One notable example is the cybercriminal gang DarkSide, which gained prominence in 2020 and was responsible for the shutdown of the Colonial Pipeline in 2021.

Foreign governments have also been implicated in ransomware attacks on hospitals. These adversarial nation-states provide a safe haven for cybercriminals, refusing to cooperate with or extradite them to the affected countries. In some cases, these hostile nations may even facilitate cyberattacks against their targets, viewing it as a way to further their national interests. This was particularly evident in the aftermath of the 9/11 attacks, where most cyberattacks on hospitals were traced back to such nations.

The impact of these ransomware attacks on hospitals can be devastating. They can disrupt patient care, delay surgeries, and force hospitals to divert ambulances and rely on paper records. They can also expose sensitive patient information and put lives at risk, with studies showing an increase in in-hospital mortality rates during ransomware attacks. The financial toll can also be significant, with hospitals having to pay ransoms or incur costs to improve their cybersecurity measures.

To combat these attacks, hospitals need to implement robust cybersecurity practices and policies at the national and international levels. While law enforcement agencies are working to address this issue, hospitals cannot solely rely on them and must take proactive measures to protect themselves from ransomware attacks. This includes investing in cybersecurity infrastructure and training staff to recognize potential threats.

Patient mortality rates increase

Ransomware attacks on hospitals are becoming increasingly common, with cybercriminals taking advantage of the COVID-19 pandemic to exploit, victimize, and profit. These attacks directly threaten a hospital's ability to provide patient care, leading to an increased risk of patient mortality.

During a ransomware attack, hospitals may be forced to redirect emergency patients to other facilities, cancel elective surgeries, and work without access to essential imaging equipment and electronic health records. These disruptions can delay patient care and increase the risk of adverse outcomes.

Research has found that in-hospital patient mortality rates increase by 20% to 35% during ransomware attacks. This means that patients admitted to a hospital during a ransomware attack are more likely to experience negative consequences. The attacks can also have a ripple effect on the wider healthcare system, impacting nearby hospitals that may experience an increase in patient volume and longer waiting times.

The impact of ransomware attacks on patient mortality is a serious concern, and hospitals may feel powerless to stop them. However, it is important to note that dying in a hospital remains unlikely, and hospitals can implement cybersecurity best practices to protect themselves and their patients. Additionally, policymakers can play a role by setting minimum cybersecurity requirements and offering financial assistance to smaller and rural facilities.

The increase in patient mortality rates during ransomware attacks highlights the need for hospitals to invest in their ability to recover from these incidents and for policymakers to address the issue through legislation and support. By prioritizing cybersecurity and working together, hospitals and governments can help mitigate the impact of ransomware attacks on patient safety.

Data breaches

One of the most common methods for launching ransomware attacks on hospitals is through phishing email campaigns. These emails often contain malicious links or malware disguised as important information related to COVID-19, such as offers for N95 masks or lifesaving ventilators. During the early days of the COVID-19 outbreak, hospitals experienced an increase in these phishing attempts as cybercriminals sought to exploit the pandemic for profit.

In addition to phishing emails, ransomware groups like Clop have been responsible for large-scale data breaches in hospitals. These groups target cybersecurity firms that work with hospitals, such as Fortra, which provides secure file transfer software. By breaching the cybersecurity firm, the attackers gain access to multiple hospitals and healthcare organizations, as seen with the attack on Fortra that affected Community Health Systems.

The impact of these data breaches can be devastating. For example, a ransomware attack on a California-based healthcare system, Prospect Medical Holdings, forced some locations to close and left others relying on paper records. Similarly, an attack on Brno University Hospital in the Czech Republic, one of the country's largest coronavirus testing centers, led to the redirection of patients to other hospitals. These disruptions can delay surgeries, divert ambulances, and hinder access to test results, ultimately putting patient lives at risk.

To protect against data breaches, hospitals need to prioritize cybersecurity. This includes implementing robust security measures, following best practices, and investing in their ability to recover from attacks. While law enforcement and government agencies work to combat these crimes, hospitals must also adapt and strengthen their defenses to safeguard patient data and ensure uninterrupted care.

Hospitals' systems and priorities

Hospitals have been increasingly targeted by ransomware attacks, with over 200 attacks reported in the first half of 2023 alone. These attacks have disrupted patient care, forced hospitals to shut down their systems, and exposed tens of millions of patients' health information. As hospitals rely heavily on their computer systems for patient records, diagnostics, and treatment plans, any disruption to these systems can have life-threatening consequences.

Hospitals' computer systems are often interconnected, with various departments and functions relying on the same network. This interconnectedness can provide a larger attack surface for cybercriminals. For example, an attack on a hospital's billing system could impact patient admissions, laboratory services, and even critical care units. Additionally, hospitals often have a large number of connected devices, such as medical equipment, which may have less secure operating systems, providing additional entry points for attackers.

To protect against ransomware attacks, hospitals need to prioritize cybersecurity. This includes implementing robust security measures, such as firewalls, antivirus software, and regular security updates. Hospitals should also ensure that their staff are trained in cybersecurity best practices, as human error or lack of awareness can often be the weakest link in an organization's security posture.

In addition to preventative measures, hospitals should also have comprehensive incident response plans in place. This includes having backup systems and data redundancy to ensure that patient care can continue even if the main computer systems are compromised. Hospitals should also have clear communication channels and protocols in place to ensure a coordinated response to an attack, involving legal, communications, and procurement teams, in addition to the IT department.

While hospitals may be tempted to pay ransoms to quickly restore their systems and protect patient care, this is generally discouraged by law enforcement agencies. Paying ransoms encourages future attacks and does not guarantee that the systems will be restored or data recovered. Instead, hospitals should work closely with law enforcement and cybersecurity experts to address the issue and mitigate the impact on patient care.

Frequently asked questions