{"id":18275,"date":"2021-04-29T05:23:58","date_gmt":"2021-04-29T01:23:58","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/ransomware-vs-healthcare\/18275\/"},"modified":"2021-04-29T05:23:58","modified_gmt":"2021-04-29T01:23:58","slug":"ransomware-vs-healthcare","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/ransomware-vs-healthcare\/18275\/","title":{"rendered":"Ransomware attacks on healthcare"},"content":{"rendered":"

A cyberattack on a clinic or hospital is literally a matter of life or death. In 2020, healthcare systems worldwide were already cracking under the strain of the COVID-19 pandemic, and the actions of cybercriminals only added to the load. One of the most significant threats of the past year for medical institutions came from ransomware attacks \u2014 cyberattacks in which cybercriminals encrypt data or extort management with threats to publish stolen data.<\/p>\n

The consequences of such attacks are manifold. In addition to the obvious and dangerous disruption to medical services, healthcare companies can face longer-term repercussions ranging from regulatory fines to claims from patients whose personal data was violated.<\/p>\n

High-profile ransomware incidents<\/h2>\n

One of the most talked-about cases of the past year, and a sign of the extent of the problem, was the Ryuk ransomware attack on Universal Health Services (UHS)<\/a> last September. The group operates 400 medical facilities in the United States, the United Kingdom, and other countries. Fortunately, not all hospitals and clinics suffered, but the attack did hit UHS facilities in several US states. The incident occurred early on a Sunday morning: Company computers failed to boot, and some employees received a ransom demand. The telephone network was also affected. The IT department had to ask staff to work the old-fashioned way, that is, without IT. Naturally, that caused major interference in the usual flow of the clinic, affecting patient care, lab tests, and more. Some facilities had to refer patients to other hospitals.<\/p>\n

In its official statement<\/a>, UHS said that there was \u201cno evidence of unauthorized access, copying or misuse of any patient or employee data.\u201d In March of this year, the company released a report stating that the attack had caused $67 million worth of damage, including data recovery costs, lost revenue due to downtime, reduced patient flow, and more.<\/p>\n

Meanwhile, an incident at Ascend Clinical<\/a>, which specializes in testing services for kidney disease, led to a data breach affecting more than 77,000 patients. The cause of the infection is known: An employee clicked a link in a phishing e-mail. Having penetrated the system, the attackers got their hands on, among other things, patients\u2019 personal data \u2014 names, dates of birth, social security numbers.<\/p>\n

An attack on Magellan Health<\/a> in April 2020 compromised the personal data of both employees and patients (365,000 victims, according to media reports). The cybercriminals somehow managed, through social engineering, to impersonate a client, gain access to the internal network, use malware to intercept login credentials, and finally encrypt data on the server.<\/p>\n

Generally speaking, when attacking healthcare facilities, cybercriminals prefer to encrypt and steal data from servers rather than workstations. The same thing happened with the servers of the Florida Orthopedic Institute, when attackers encrypted the (previously stolen) data of 640,000 patients. That resulted in a rather unpleasant class action lawsuit<\/a>.<\/p>\n

The above is just a sample of high-profile incidents from the news last year. In fact, we had dozens more to choose from.<\/p>\n

How healthcare institutions can secure themselves<\/h2>\n

Malware can penetrate a system in a variety of ways: through e-mail attachments, phishing links, infected websites, and more. Attackers can steal remote-access credentials, coax them out through social engineering, or simply use brute force<\/a>. The old medical adage that prevention is better than cure applies equally well to cybersecurity, and not least to protection against ransomware. Here are our preventive-care tips for all things cyber:<\/p>\n\n