The healthcare sector has always been a lucrative target for cybercriminals as it possesses a vast trove of patients’ data. Unfortunately, the current COVID-19 outbreak has become one of the major reasons for medical treatment facilities to protect their patients’ health data as the number of coronavirus-infected patients increase.
Zooming in on healthcare breaches
According to the HHS Breaches database, about 143 breaches have been reported so far in 2020 affecting the PHI of an estimated 3.3 million individuals. Some of the major data breaches from the first quarter of the year included:
- A phishing attack at Beaumont Health that affected the medical records of 112211 patients.
- An email security breach at Arizona Endocrinology Center that resulted in the compromise of 74122 health records;
- An email hacking incident at Ambry Genetics Corporation that exposed medical information of nearly 232772 individuals;
- Unauthorized email access at Munson Healthcare that affected medical and personal records of 75202 patients; and
- A data security hack at SOLO Laboratories, Inc. that affected impacted 60000 individuals.
The one threat that doesn't go away
With the healthcare industry under time constraints and pressure due to the ongoing pandemic, hackers are counting on the organizations to pay ransoms to recover their critical systems storing patients’ data and to prevent disruption to patient care.
Below mentioned are some prominent ransomware attacks that targeted healthcare, and related firms amidst the COVID-19 pandemic:
- Maze actors stole and encrypted medical data of thousands of patients belonging to Hammersmith Medicines Research LTD, the UK-based drug testing company, and then published the data after the failed ransom payment negotiations.
- Bitcoin ransomware Ryuk targeted 10 healthcare organizations over the past three months despite most of them being daily flooded with fresh COVID-19 cases.
- Colorado-based Parkview Medical Center’s technology infrastructure was forced to shut down its IT systems after it was hit by ransomware on April 21, 2020.
- A potential ransomware attack at Brandywine Urology Consultants resulted in the compromise of PHI of about 131,825 patients. The attack had occurred on January 27, 2020.
In addition to ransomware attacks, Palo Alto Unit 42 researchers had reported cyberattacks that used COVID-19 themed threats to target healthcare organizations and a Candian medical research university.
What should healthcare firms be wary of?
At a time when healthcare firms are struggling to handle patients suffering from COVID-19, criminal groups are seeking to exploit the crisis to hit the sector.
The ramification of such attacks, especially during the outbreak, could be devastating for patients seeking immediate treatments. An attack on a healthcare provider can lock computers that typically contain electronic medical records. This means that doctors and nurses cannot access information about their patients’ medical history, the dosages of drugs that patients require, and other critical information.
What next?
The U.S. Defense Department, along with several regulators, has stressed protecting the PHI of patients amidst the coronavirus pandemic. They have released a list of guidelines for healthcare organizations to secure their critical assets that process data. Some of the best practices include:
- Incorporating multifactor authentication and strong passwords across critical assets;
- Timely identification and mitigation of network vulnerabilities;
- Encrypting PHI; and
- Limiting access to patients’ health records.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/3c1d_shutterstock_674295670.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/95f6_shutterstock_1078632860.jpg)
