Healthcare Sector Accounts For 43% Of UK Data Breaches
The UK health sector suffered a disproportionate number of data breach incidents between January 2014 and December 2016. In total, healthcare organisations suffered 2,447 incidents and accounted for 43% of all reported incidents in the time period.
By comparison, the second highest was local government, with 642 reported incidents, an 11% share. The data, received from the Information Commissioner’s office, also shows that human error accounts for the almost half of these incidents across every sector.
Analysis of the data found a clear spike in data breach incidents within UK healthcare organisations. Comparing the last quarter (October – December) of the past three years, healthcare organisations were found to consistently top the list for data breach incidents. Furthermore, the number of incidents rose year on year, with a 20% increase, from 184 incidents in the last quarter of 2014, to 221 in the last quarter of 2016.
Critically, the findings showed that the many of these incidents are attributed to human error, rather than external threat. Taking the 221 incidents occurring between October and December 2016, the top-ranking incident types were:
1. Theft or loss of paperwork – 24%
2. Other failure – 22%
3. Data faxed/posted to incorrect recipient – 19%
4. Data sent by email to incorrect recipient – 9%
5. Failure to redact data – 5%
A new report from Vectra Networks into cyber security trends shows healthcare to be the most frequently targeted industry, with 164 threats detected per 1,000 host devices.
Next most targeted are education and media, which had 145 and 123 detections per 1,000 host devices, respectively. By comparison, the food and beverage industry came in as the least targeted industry with just 17 detections per 1,000 hosts.
The study from Vectra Networks revealed recently at Infosecurity Europe event reveals that attack rates are increasing with the average number of reconnaissance, lateral movement and exfiltration detections all up by more than 265 percent.
Media organisations experienced the highest rates of exfiltration, with 34 detections per 1,000 host devices. The rates of exfiltration attempts can likely be attributed to the its decentralised supply chain made up of small businesses with limited IT staff.
The entertainment industry experienced above-average rates of the five attack behaviors measured. Only the food and beverage industry experienced below-average detections for all activity measured.
Reconnaissance detections were up by 333 percent compared to 2016. Internal reconnaissance is a necessary first step for ransomware campaigns, so the sharp increase in detections may be an early indicator of the recent rise of attacks such as WannaCry.
The finance and technology sectors have proved to be the most resilient. These industries have below-average detection rates, with 37 and 38 detections per 1,000 hosts, respectively. This indicates the presence of stronger policies, mature response capabilities, and better control of the attack surface.
Recent Events
“Following the WannaCry exploit, the vulnerability of the healthcare industry, and the critical importance of improving its cyber-security, has come into sharp focus,” said Tony Pepper, CEO and co-founder of Egress Software Technologies. “While it’s clear there is a security problem in healthcare, these figures show that it is as much about internal activity as external threat.
“There’s no doubt that someone inadvertently emailing a spread-sheet containing sensitive patient details to the wrong person isn’t as good a headline as a ransomware attack, but that does not diminish the threat it poses.”
While healthcare had the highest volume of incidents, others are increasing more rapidly. Across all sectors, the total number of security incidents reported has increased by almost one-third (32%) since 2014.
The courts and justice sector has experienced the most significant increase in incidents, a 290% hike since 2014, placing it in the top five worst affected industries by the last quarter of 2016.
Other significant increases can be seen in the central government and finance industries, with 33% and 44% increases, respectively.
The ‘human element’ – where internal staff have made mistakes – accounted for almost half of total data breach incidents: 44% October-December 2014, 43% 2015 and 49% 2016. Data shared in error is the single highest contributor to breaches year-on-year resulting from human error, annually, causing roughly one-third of incidents.
“We are all aware that security incidents are rising, but many may not suspect how large a proportion of these are down to error and lack of control over sensitive data,” continued Pepper.
“What the information from the ICO makes clear is that all businesses need to do more to better protect sensitive information. Meeting this challenge requires a combination of improved employee training and the communication of risks, and the deployment of the right technologies to minimise the number opportunities available for human error to take hold.”
You Might Also Read:
How Cybercrime Affects The Healthcare Industry:
What Healthcare CISOs Should Know:
Healthcare Starts Spending Big On Cybersecurity:
