The healthcare industry is a hot target for cyberattacks, where hackers infiltrate an organization’s operating system to encrypt records or secure stolen patient data.
Data compiled by HIPAA Journal saw 707 data breaches of 500 or more records reported in 2022 – an average of 2 healthcare data breaches of 500 or more records were reported each day.
What’s the reason for the increase? And what do healthcare companies have that other businesses don’t?
Healthcare organizations attract hackers due to the large amounts of patient data they store. Some organizations can store tens of thousands, even millions of patients, in one operating system. The patient records they keep are detailed, can be easily monetized, and hold personal information such as:
Unlike credit cards that can be canceled at any time, healthcare records have a long lifespan. They can be misused and go undetected for long periods of time because it is harder to identify malicious activity.
Another reason healthcare organizations are an easy target for hackers is due to their complex and hard-to-secure operating systems. Many systems organizations use are obsolete but cannot be transferred to supporting systems. And if they can be transferred, the upgrades are not cheap.
Stealing medical records and patient data is so valuable for a hacker because the data can be used to commit multiple crimes. One full set of records can help a criminal:
Once the data has been taken, there are a variety of ways to make money.
Criminals have the opportunity to choose how much data they purchase on the dark web. A single social security number can go for as little as $1, while a driver’s license can sell for $20.
Stolen data can also be packaged with other data to create full record sets. These sets contain extensive information on individuals. They are often sold to other criminals who use the data to obtain social security numbers, driver's licenses, and passports. All of this data creates an identity package that can sell for upwards of $1,000.
See more: What happens to patient information on the dark web?
Ransomware is a popular tool hackers use to encrypt files in an organization’s software and prevent access to any of their systems. This causes massive disruptions in the organization and can delay medical procedures putting the patients at risk.
Ransomware attacks are usually followed by forcing the organization to pay a ransom in order to decrypt its data. And since healthcare organizations rely on patient records every day, they are more likely to pay the ransom than other businesses that don’t rely on data day to day.
See more: What is ransomware and how to protect against it
Extortion is a step up from ransomware where individual victims are targeted. Hackers will contact victims directly and threaten to leak their personal information if they do not pay a ransom fee.
While cybersecurity attacks aren’t 100% preventable, there are many things an organization can do to keep attacks at bay.
When measuring your organization’s security standards, remember that Paubox provides an easy, compliant email solution. Our Paubox Email Suite provides advanced email threat protection to keep your organization secure and patient data safe. Paubox offers robust inbound email protection against threats like malware, spam, viruses, and phishing scams.
Paubox Email Suite for HIPAA compliant email
Keep your patient data safe from ransomware, phishing attacks, and other dangers with advanced email threat protection.