How Cybercrime Affects The Healthcare Industry

The Healthcare industry has featured in the top 5 industries attacked by cyber criminals for a number of years now.  

The recent WannaCry ransomware attack across the globe that affected many health trusts across England and Scotland has brought the health impact of the cyber threat to the forefront of media and political debate in the run up to the 2017 General Election. So why would anyone want to attack healthcare and what are the threats?  

2016 was a very difficult year for healthcare when it came to cyber-attacks and developing cyber threats.  According to the TrapX Security 2016 Healthcare Cyber Breach Research report, “the nature of the threat continues to diversify into a greater variety of complex attacks promoted by sophisticated and persistent human attackers. 

These attacks against hospitals and medical organisations are still driven by the lucrative economic rewards for organised crime. Medical records are among the most complete set of records available and, hence, are in demand for a variety of reasons.

In October 2016, Ben Gummer, now the ex-Minister for the Cabinet Office and Paymaster General warned that the NHS was at risk of cyber-attacks, saying that “hacking is "no longer the stuff of spy thrillers and action movies" but a clear and present threat and large quantities of sensitive data held by the NHS and the Government is being targeted by hackers.”

In January 2017 Barts Health Trust warn its staff that the trust’s four hospitals in East London: The Royal London, St Bartholomew’s, Whipps Cross and Newham were experiencing a “ransomware virus attack.”  This came after similar attacks on Northern Lincolnshire and Goole Foundation trust in the previous October.

A recent report on the Deep Web black market for electronic health records (EHRs) by researchers affiliated with the Institute for Critical Infrastructure Technology pointed out that “healthcare systems are relentlessly and incessantly attacked by different types of attackers.”

One of the reasons that medical networks remain vulnerable is that many legacy systems and devices lack the ability to be updated and patched, yet are connected to networks.  Or the updating of systems, often via patches provided free from operating system vendors, is not seen as a priority by senior managers and something “IT are responsible for”. It therefore doesn’t matter if the newer devices are completely up to date as the organisation’s “Internet of Medical Things (IoMT)” becomes vulnerable to its weakest link.

Medical records, especially but not exclusively in the USA, by dint of their comprehensive nature, sell for hundreds of dollars on the Dark Web and there is no shortage of them.  

According to the IB Times last year, a hacker claimed to have broken into multiple healthcare databases across America and listed a fresh trove of 9.2m records on a Dark Web based marketplace for 750 Bitcoin (£368,000). The vendor, using the pseudonym 'The Dark Overlord', claims the plaintext 2GB database includes names, addresses, emails, phone numbers, date of births and Social Security Numbers (SSNs) belonging to 9,278,352 Americans.

However, for those compromised, many don’t realise that their records can be sold repeatedly by the criminal networks operating in the Dark Web and that this could cause long term problems.

Information that is contained in medical records can be used for many different types of identity fraud and phishing attacks and because of its comprehensive nature, the threat from these can persist for many years.

In the UK, the attack vector seems to be different to the USA and attacks are mainly via ransomware. Trying to extort money from vulnerable hospital trusts rather than individuals.   NHS hospital trusts in England reported 55 cyber-attacks in 2016, according to data obtained by the BBC from NHS Digital, who oversees cyber security.

The WannaCry attack has blown this statistic away and will put a spotlight on cyber security across healthcare in the UK. As the attack unfolded, Eugene Kaspersky from Kaspersky Labs said that it, “looks like a cyberattack of a criminal nature but with a global impact that's very close to terrorism.”  Kaspersky continue to help Europol to try and track the perpetrators.

Until now, NHS Digital reported a steady increase in reporting but were quick to point out that this increase didn’t necessarily mean an increased number of attacks, just better awareness and they didn’t believe any patient records had been compromised.  Oliver Farnan, from the Oxford Cyber Security Centre, said ransomware attacks had become more common and 'The risk is going to increase'; how right he has been.

Advising on the threat to the NHS in the UK falls to CareCERT who have been analysing threat intelligence and broadcasting relevant, focused advisories to health and care organisations since October 2015, with partners in industry and using links across the public sector, including the NCSC, CERT-UK, CESG and CPNI.

With this emerging threat potentially affecting all our health, what better place to gain a clearer understanding of how to counter it, than at the UK Security Expo at the end of November 2017

UKSecurityExpo:

You Migt Also Read:

What Healthcare CISOs Should Know:

Healthcare Starts Spending Big On Cybersecurity:

Stolen Health Records Flooding Dark Web Markets:

British NHS Hospital Trust Under Cyber Attack:

 

« Cambodia’s Cyber War Room
Stephen Fry: Facebook Classed as Publishers »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Ikerlan

Ikerlan

Ikerlan is an R&D technology centre specialising in areas including embedded systems, industrial automation and industrial cybersecurity.

Towergate Insurance

Towergate Insurance

Towergate Insurance is a leading UK specialist insurance broker. Business products include Cyber Liability Insurance.

DefCamp

DefCamp

DefCamp is the most important annual conference on Hacking & Information Security in Central Eastern Europe.

NT Cyfence

NT Cyfence

CAT Cyfence is the IT Security services business unit of CAT Telecoms.

Intelligent Business Solutions Cyprus (IBSCY)

Intelligent Business Solutions Cyprus (IBSCY)

IBSCY Ltd is a leading provider of total IT solutions and services in Cyprus specializing in the areas of cloud services and applications, systems integration, IT infrastructure and security.

Capula

Capula

Capula is a leading system integration specialist for control, automation and operational IT systems across all applications and industry sectors.

Kapalya

Kapalya

Kapalya empowers businesses and their employees to securely store sensitive files at-rest and in-transit across multiple platforms through a user-friendly desktop and mobile application.

Forgepoint Capital

Forgepoint Capital

ForgePoint Capital is a premier venture investor for early stage cybersecurity companies.

RackTop Systems

RackTop Systems

RackTop Systems is the pioneer of CyberConverged data security, a new market that fuses data storage with advanced security and compliance into a single platform.

Iowa Cyber Hub

Iowa Cyber Hub

Iowa Cyber Hub is a cybersecurity education partnership between Iowa State University and Des Moines Area Community College.

Center for Information Technology Policy (CITP) - Princeton University

Center for Information Technology Policy (CITP) - Princeton University

The Center for Information Technology Policy at Princeton University is a nexus of expertise in technology, engineering, public policy, and the social sciences.

Luxembourg House of Financial Technology (LHoFT)

Luxembourg House of Financial Technology (LHoFT)

Offering start-up incubation, co-working spaces including a soft-landing platform, the LHoFT connects and creates value for the entire Luxembourg FinTech ecosystem.

StickmanCyber

StickmanCyber

At StickmanCyber we are on a mission to create a digital world that is safe for everyone - we are your trusted cybersecurity partner.

link22

link22

link22 offers a high level of expertise within IT security and system solutions. We help public and private actors with highly secure IT-solutions.

Insight Enterprises

Insight Enterprises

Insight is a leading solutions integrator, helping you navigate today’s ever-changing business environment with teams of technical experts and decades of industry experience.

Circle Security

Circle Security

Circle’s breakthrough security API unifies solutions for identity and data security into one architecture and empowers organizations to secure their identity, data and privacy in their applications.