Cybersecurity: how healthy are our hospitals?

Digital transformation is revolutionizing every sector and every organization, both public and private. And healthcare facilities are no exception. Across hospitals today, connected devices are everywhere to be found, while more and more confidential patient information is being digitized. Though rapid technological developments are certainly increasing the quality of healthcare, this is accompanied by a huge growth in the threats to hospitals and patients, plus the risks of attacks on their data.

Day-to-day activity at hospitals is going digital, with an increasing amount of equipment such as pacemakers and insulin pumps being digitally connected. These can send data on their operating status or on the patient, and can even be programmed remotely. In 2016, 114,000 patients at a pharmaceutical laboratory were contacted after a security flaw was found in an insulin pump model. The control unit contained a vulnerability which, if exploited, could be used to inject the patient with a potentially fatal dose of insulin.

Obsolete IT environments

Workstations are also connected, so they can access email and tools such as scanners and MRI machines. Yet, many facilities still operate using an obsolete IT environment, according to McAfee. A study by Deloitte of 24 hospitals in 9 EMEA countries also revealed that more than half of them use standard default passwords to secure their hardware. What’s more, only a fifth of hospitals surveyed said that the majority of their IT equipment uses secure networks to ensure the reliability and confidentiality of their data.

Data worth more than gold

Hackers are increasingly targeting facilities like these, as the data they can steal is so valuable. In fact, the information stored by hospitals (like medical records and social security numbers) is worth more than gold to them. Data can be sold on the black market for around 50 dollars – that’s 50 times what a credit card number is worth, according to Symantec.

No wonder cyberattacks are increasingly targeting hospitals. And there’s no shortage of cases. In May 2017, a global cyberattack caused millions of computers to be blocked. The culprit… WannaCry ransomware. The UK’s healthcare service, the NHS, was one of the worst hit by the attack. Thousands of consultations, examinations, and surgeries had to be canceled in more than 40 facilities after their systems were blocked. The NHS had failed to download a Windows update which would have prevented WannaCry from infecting it. Hundreds of thousands of other computers are still running on Windows XP – a real security loophole.

Attacks that cost dearly

In March 2016, the Locky virus blocked access to nearly 10,000 files, or 3% of the content of an IT department at a hospital in Boulogne-sur-Mer, northern France. In February that year, a hospital in California paid 17,000 dollars’ worth of bitcoins to regain access to its IT system. MedStar Health, an IT system used to manage around a dozen hospitals in Maryland, United States, also had its network shut down after a cyberattack. And the list of cyberattack victims in the healthcare sector continues to grow and grow.

In the second quarter of 2016, hospitals were the target of 88% of ransomware attacks, according to a study by security solutions provider NTTSecurity.

The importance of a security policy and raising awareness

Hospitals dedicate very little of their financial and physical resources to their IT security – just 6% of their budget in 2016 compared to the industry average of 16%, Symantec explains. But repeated cyberattacks have made them more aware of the need to act now to protect their IT system and their patients’ data by putting a security policy in place. According to the Hospital Information Systems Atlas published every year since 2013 by the French Directorate-General for Healthcare, 91% of healthcare centers have a security policy in force. The Digital Hospital program aims to raise this figure to 100% by January 1, 2018.

Oodrive – the software publisher specializing in managing sensitive data – provides online backup solutions to recover your data after a cyberattack, as well as certified collaboration solutions used by companies with the most stringent security requirements.

Image© FreeRange