Defending U.S. Hospitals Against Today’s Cyber Threats
The cost of cybercrime is often calculated in terms of financial loss, inconvenience, or reputational damage. But when it comes to health and hospital systems, the harm caused by a cyber attack can be far worse.
Ransomware-encrypted systems can delay the delivery of life-saving treatment. Data breaches can expose the personal data of vulnerable patients. Entire health systems have had their systems shut down due to cyber attacks, with an increased risk to human life.
In one of the worst examples, in October 2020, a woman was diverted from emergency care at a local hospital and sent to a facility 20 miles away. The local hospital’s servers had been encrypted during a ransomware attack, and the hospital could not accept patients. Tragically , the woman died.
Cyber-Attacks Escalating Against Hospitals and Patients
During the COVID-19 pandemic, cyber-attacks on health and hospital systems and their patients have escalated. Concerns about the virus have enabled criminals and scam artists to fool hospital employees into clicking on email links with the promise of scarce protective equipment. Instead of providing the expected goods however, the emails delivered malware that led to encrypted systems and data breaches.
In an effort to cope with the enormous influx of contagious patients, hospitals have expanded their use of internet-based technology. But while remote access and tele-health services facilitate ongoing care, they also create more opportunities for attackers to infiltrate systems.
Common Cyber Threats Facing Hospitals Today
In the U.S. it seems, not a day goes by without some kind of cyber-attack against a hospital or health system. The U.S. Department of Health and Human Services Office for Civil Rights maintains a website listing all of the breaches affecting 500 or more individuals. The list demonstrates how successful hackers continue to be using everyday tools such as email.
The most common threats to hospitals are the same as those targeting private businesses and public organizations, but with potentially more dire consequences:
1. Ransomware
By encrypting critical systems, ransomware can interfere with hospital operations and lock patient records, preventing care. For example, a lack of information about allergic reactions or a delay in lab results can postpone critical treatments.
2. Phishing
While phishing has been a problem for many years, there has been a 700% increase in COVID-themed phishing emails directed towards the healthcare sector and the general public. Phishing is one of the main delivery vectors for ransomware and other types of malware.
3. Data Breaches
According to the Office of Civil Rights website, 12.6 million individuals were affected by 162 hacking incidents on healthcare entities within a three-month period. The types of data targeted by cyber attackers include:
- Personally-identifiable information (PII)
- Protected Health Information (PHI) and other health care records
- Payment information
- Business intelligence
- Intellectual property
Protecting U.S. Hospitals From Today’s Cyber Threats
It’s bad enough that hospitals are facing the strains and stresses of caring for COVID-19 patients. In today’s connected world they also have to deal with hackers, spies, and criminals seeking to take advantage of their position as caregivers. Health and hospital systems should use every means at their disposal to protect their systems. However, with the reduced revenue resulting from the pandemic, adequate investment in cybersecurity can be challenging.
That’s why, in partnership with Akamai, the Center for Internet Security (CIS) is offering a Malicious Domain Blocking and Reporting (MDBR) service AT NO COST to all public and private hospitals and related healthcare organizations in the United States.* This service provides an additional layer of cybersecurity protection that is proven, effective, and easy to deploy.
CIS is offering this defensive solution at no cost as part of our mission to make the connected world a safer place. Our nonprofit status and mission focus enable us to offer this ransomware protection at no cost to any public or private hospital or healthcare system that can benefit from it. All U.S. hospital systems are encouraged to register.
*While MDBR was offered at no cost to U.S. private hospitals for a limited time, that offering has been discontinued in favor of MDBR+, a low-cost, cloud-based secure DNS service that provides real-time reporting, custom configurations, and off-network device protection. Learn more about MDBR+ here.