More than a quarter of organizations have suffered a financial loss of $1 million or more due to cyberattacks, according to research released this week by cybersecurity company Claroty.
Many of these victims were in the healthcare industry — which remains especially vulnerable to cybercriminal activity. More than three-quarters of healthcare organizations reported paying more than $500,000 in ransom as a result of cyberattacks, the report noted.
The report, published Wednesday, is based on a survey of 1,100 professionals working in infosecurity, operational technology engineering, clinical and biomedical engineering, and facilities management. They were questioned about the business impacts caused by cyberattacks on their organizations in the past year.
What Are Healthcare Organizations Getting Wrong about Email Security?
A new report by Paubox calls for healthcare IT leaders to dispose of outdated assumptions about email security and address the challenges of evolving cybersecurity threats.
Healthcare cyberattacks have surged in recent years due to a few key reasons, said Ty Greenhalgh, industry principal at Claroty’s healthcare division.
“First, the complexity of hospital networks has grown, incorporating not only traditional IT devices but also a wide range of medical devices, IoT systems, and building management systems. Securing medical devices is particularly challenging, as it requires deep knowledge of clinical data flows essential for patient care to ensure safe network segmentation,” he declared.
He also pointed out that the rise of ransomware has drastically increased the number of attackers — and that cybercriminals’ social engineering techniques are getting more sophisticated, allowing them to exploit more vulnerabilities.
Additionally, it is difficult for healthcare organizations to manage third-party secure access because vendors use a variety of connection strategies, Greenhalgh added.
A Path to Healing: Discovering Arizona’s PTSD Treatment Centers
Explore top PTSD treatment centers in Arizona, offering personalized care, holistic therapies and expert support to help individuals heal and reclaim their lives.
When a hospital suffers a ransomware attack, the costs extend far beyond the ransom itself, he declared.
He referenced a study showing that ransomware attacks increase patients’ in-hospital mortality by as much as 55%.
“Cybersecurity is patient safety. A long term strategy suggests you are profitable to stay charitable. Keeping the doors of the healthcare organization open is also patient safety. Victims of cyberattacks face significant financial losses due to operational downtime, lost revenue and recovery costs — which include restoring systems from backups and forensic investigations,” Greenhalgh explained.
Additionally, ransomware attacks usually result in lawsuits and legal fees, regulatory fines for non-compliance, and damage to the hospital’s reputation — all of which can lead to a loss of trust and in patient and business relationships, he pointed out.
Aware of cyberattacks’ massive financial consequences, healthcare organizations have begun to take cybersecurity more seriously in the past couple of years.
“Healthcare organizations have made significant strides in improving their cyber defenses by
adopting risk reduction strategies, securing critical assets and strengthening network protection,” Greenhalgh stated.
Many hospitals are investing in visibility tools for asset inventory, which can help them define the scope, understand granular details about devices, and prioritize critical assets, he noted. He also pointed out that healthcare organizations have started implementing secure access controls and threat detection capabilities, particularly around remote access, to reduce the chances of unauthorized entry into their networks.
Despite this progress, hospitals are still struggling to manage third-party risk.
“The report highlights that many institutions lack a full understanding of third-party connections to their systems, which is critical for preventing supply chain-based attacks. Healthcare providers also need to invest more in vulnerability management, comprehensive risk assessments, and patching known exploits,” Greenhalgh remarked.
He recommended that healthcare organizations align their strategy with HHS’ set of voluntary cybersecurity guidelines, as these are designed to address their unique vulnerabilities and adapt to the increasing complexity of cyber threats.
Photo: boonchai wedmakawand, Getty Images