Trends in Malware Attacks against United States Healthcare Organizations, 2016-2017

Abstract

Introduction: The healthcare industry has begun seeing a new hazard develop against them-the threat of cyberattack. Beginning in 2016, healthcare organizations in the United States have been targeted for malware attacks, a specific type of cyberattack. During malware incidents hackers can lock users out of their own network to gain access to information or to hold the organization for ransom. With the increase in medical technology and the need for access to this information to provide critical care, this type of incident has the potential to put patient lives and safety at risk. Methods: A content analysis was conducted to assess the trend of attacks on healthcare organizations. U.S. Healthcare IT News and Becker's Hospital Review were used to collect all publicly reported malware attacks against U.S. healthcare organizations between 2016 and 2017. A logic diagram was also developed to illustrate how hackers gain access to a healthcare network using malware. Results: There were 49 cases of malware attacks against U.S. HCOs identified. The attacks occurred across 27 states, and they took place during 18 out of 24 months. Six of the organizations reported paying ransom, whereas 43 organizations did not pay or did not report payment to the press. Impacts of these attacks range from network downtime to patient and staff records being breached. Discussion: Malware attacks have the potential to impact care delivery as well as the healthcare facility itself. Even though this study identified 49 malware attacks, we know this number is significantly higher based on data from HIMSS and the FBI. A reporting loophole exists in that hospitals are only required to report attacks in the case of breached protected health or financial data. For HCOs to fully understand the risk cyberthreats pose, it is important for attacks to become public information and for lessons learned to be shared. Future research reviewing identified attacks could help identify best practices for the healthcare industry to better prepare for cyberattacks.

Protecting your organization from e‐mail phishing and ransomware attacks

“…Cyberattacks have been increasing worldwide and are a growing concern for health care organizations, which are ideal targets because they often have out‐of‐date cybersecurity systems and provide limited training for staff members on safety practices 1,2 . In a 2019 survey of 166 information security leaders at a variety of health care facilities, more than three‐fourths reported experiencing a significant security event in the last year 3 .…”

“…In a 2019 survey of 166 information security leaders at a variety of health care facilities, more than three‐fourths reported experiencing a significant security event in the last year 3 . The health care sector is especially susceptible to cyberattacks because interruptions in services can have wide‐ranging consequences; for example, disclosure of patient health information can lead to identity theft and medical fraud, and loss of personnel access to medical records can affect patient safety 1,2,4 …”

“…Cyberattacks can come from inside the organization, such as through negligent employees, or outside the organization, such as through online scam artists and attackers 3 . Facility computers or networks can be accessed through e‐mail, hardware or software infected with malicious software (i.e., malware), compromised medical devices, third‐party web sites, or wireless networks 2,3 . Cybersecurity threats that have had a major effect in health care include e‐mail phishing and ransomware attacks 4 .…”

Contemporary Policy Challenges in Protecting the Homeland

“…For example, health‐care systems are entirely connected and grossly vulnerable to ransomware attacks. In many cases, these crimes are dealt with outside of law enforcement but hold the ability to completely paralyze hospitals for days at a minimum (Branch et al, , ). More dramatically, the country of Georgia found itself unable to communicate from distributed denial of service attacks that took place in the summer of 2008 (Korns & Kastenberg, ).…”

“…Moreover, these data represent a fraction of data in the area. Data for acts of cybercrime and cyber terrorism are mostly unavailable, and those that exist only address relatively well‐known instances of cybercrime (Branch et al, ). The gray area between crime and terrorism hampers efforts to categorize the real probabilities of terror acts systematically.…”