News and Events 
The Federal Bureau of Investigation (FBI) recently issued a warning that iPhone and Android users should begin using encrypted messaging apps to protect the privacy of
Healthcare organisations across Europe must take precautions to protect their systems to reduce their risk of cyber attacks.
Ransomware Is a Growing Threat for European Healthcare Organisations
Every day, it appears that a different hospital is making headlines due to a data violation.
Cybercriminals are increasingly targeting healthcare. According to a global study of healthcare IT professionals conducted in June 2022, 66% of healthcare organisations were hit by ransomware attacks in 2021, alarmingly up from 34% the previous year.
After enduring the turmoil of Covid-19, healthcare workers are undeniably exhausted. With so much on their plates, they may not be giving the same attention to password complexity, connection security, and compliance protocols as usual. Cybercriminals are well aware of this industry-wide fatigue and see it as a chance to take advantage for their own gain.
Criminals aiming to obtain patient data are constantly adjusting their approaches based on the particular situation healthcare organisations are facing. Increasingly, the trend sees cyber attacks being launched during peak holiday times, when criminals count on hospitals having limited personnel and weaker safeguards.
Money is always the primary motive behind these attacks. By stealing and holding patient data or medical systems hostage, criminals can extort huge sums from hospitals and other healthcare providers who are desperate to keep operations running.
As Personal Health Information (PHI) is more lucrative on the black market than credit card credentials or other forms of Personally Identifiable Information (PII), cybercriminals are increasingly targeting medical databases.
According to the Centre for Internet Security, the average cost of a stolen record incurred in a data breach by a non-healthcare related agency is $158. However, for healthcare agencies the cost is an average of $355. While PII and credit card data only sell for around $1-$2, PHI can be worth as much as $363 according to the Infosec Institute. This is because a person’s medical history, such as their ailments, illnesses, and surgeries, cannot be changed, unlike credit card information or Social Security Numbers.
Hackers may resort to stealing medical record data from patients in order to create “identity kits” on the dark web which can be sold for up to $2,000. These kits can then be used to generate fraudulent IDs, make false insurance claims or carry out other fraudulent activities.
The Cost to Healthcare
Criminals are acutely aware that healthcare is the most likely sector to pay a ransom. According to the previously mentioned ransomware report, healthcare ranked first with 61% of organisations paying a ransom to get encrypted data back, compared with the global average of 46%. This was almost double the 34% who paid a ransom in 2020.
A recent data breach report revealed that the costs associated with healthcare breaches have reached an all-time high, increasing by 42% in the past two years alone. Healthcare breach costs have been higher than any other industry for 12 years running, increasing by 42% since 2020. The average cost of a data breach incident in healthcare now stands at over $10 million.
A report on ransomware attacks on US healthcare organisations detailed how these attacks can disrupt operations and patient access for weeks or even months. The report found:
- 44% of targeted organisations experienced a disruption in the delivery of healthcare.
- 9% had operations disrupted for more than two weeks.
- 16% reported stolen PHI was published by hackers, typically on dark web forums.
- Common disruptions included electronic system downtime (42%), cancellations of scheduled care (10%) and ambulance diversion (4%).
Looking at the global ransomware survey, 94% of those attacked said it had a ‘serious effect’ on their operations. Furthermore, 90% of private healthcare operators reported a loss of business or revenue.
2023 – The Story So Far
Since the start of 2023, media has reported on numerous cyber attacks affecting hospitals and healthcare organisations all over Europe.
The year started with the university medical center in Maastricht (MUMC+) and the cybersecurity agency Z-CERT being hit by the pro-Russian hacker group Killnet which launched a Distributed Denial-of-service (DDoS) attack. A few weeks later, in February, the websites of nine hospitals in Denmark were shut down due to DDoS attacks performed by a relatively new hacker group known as Anonymous Sudan.
Hospital Clínic de Barcelona announced in early March that it experienced a ransomware attack which forced thousands of appointments to be canceled, among other services. Officials said that hundreds of non-urgent operations were canceled alongside 3,000 patient checkups, including radiotherapy visits, because staff were not able to access patients’ clinical records.
A university hospital in Brussels was also targeted in March. The attack hit the Centre Hospitalier Universitaire Saint-Pierre where staff were forced to use paper records, and ambulances and medical vehicles had to be diverted to neighbouring establishments out of precaution.
That same month, Walsall Healthcare NHS Trust, a UK public sector healthcare provider, which provides local hospital and community services to around 260,000 people, was also hit. The nature of the cyber attack has not been confirmed, although the hospital said it was working with both the UK’s National Cyber Security Centre and the data protection regulator.
The British government has since published its new cybersecurity strategy for the National Health Service with the goal of making it highly resistant to cyber assaults no later than 2030. This is in response to numerous ransomware attacks on the NHS in recent years, as well as other international incidents.
Defending Against Cybercrime in Healthcare
A recent data breach investigations report showed that 81% of data breaches are caused by weak or stolen passwords. The use of a password manager is recommended by government agencies and industry experts to combat this. A password manager is software that creates and securely stores passwords, so that all of their accounts can be accessed with a single master password. This not only makes it easier for users to remember their passwords, but also reduces the risk of weak passwords and password reuse.
Keeper Security offers enterprise-level password and credential management for businesses of all sizes. With its Enterprise Password Management (EPM) and Privileged Access Management (PAM) solutions, Keeper has built a reputation for delivering top-notch security features and usability. Keeper is proud to have the longest-held SOC2 and ISO 27001 certifications in the industry. It is also GDPR compliant.
Keeper utilizes a zero-trust, zero-knowledge security infrastructure to ensure users are protected on every device they use. This means that users can have peace of mind that their passwords, documents and other data are safeguarded within their vaults.
Keeper is highly esteemed by users on G2, the world’s leading software marketplace, as a top-tier password manager for both large companies and small to mid-sized businesses. Notably, reviewers have praised Keeper’s user-friendliness, complimenting its straightforward implementation, administration and end-user experience.
Hospitals and healthcare organisations in Europe have been greatly affected by cyber attacks in recent years. To help protect their data and systems, organisations should use a secure password manager such as Keeper. Taking the right precautions will lessen the likelihood of falling victim to a future cyber attack.
