Exposed: Why Cybercriminals Target the Healthcare Industry and How to Thwart Them

The following is a guest article by Trevor Dearing, Director of Critical Infrastructure Solutions at Illumio

We’re not even halfway through 2024, and the healthcare industry has already suffered over 250 breaches that exposed the sensitive health information of over 32 million individuals. More than ever before, it’s critical that healthcare decision-makers and regulators prioritize cybersecurity in order to ensure patient safety and quality care.

Cybersecurity Landscape in Healthcare

The COVID-19 pandemic accelerated healthcare organizations’ digital transformation initiatives. They’ve increased their investments in automation technologies and migrated their IT systems and applications to the cloud to increase operational efficiency and lower costs. However, they have also weakened their cybersecurity postures and the consequences can be devastating.

Consider the Change Healthcare cyberattack last March that affected patients, providers, clinics, and pharmacies. United Healthcare (Change Healthcare’s parent company) estimates mitigating the damage could cost up to $1.6 billion. That doesn’t include the $22 million in bitcoin as ransom Change Healthcare paid to BlackCat, the ransomware group responsible for the attack. 

Cybercrime is a booming industry and the healthcare industry is a prime target. Fighting back requires making the organization a less profitable target. That begins with refusing to pay ransom demands. 

Why Paying Ransoms Incentivize Malpractice 

Ransomware gangs and hackers try to force healthcare providers into a difficult position: either pay the ransom or risk the theft or exposure of patients’ private data or disruption to critical operations. In 2023, the U.S. and 50 other members of the International Counter Ransomware Initiative signed a pledge that their governments would not pay ransoms to cybercriminals. Paying ransoms emboldens the attackers by encouraging them to repeat these attacks. Additionally, paying ransoms does not guarantee that the data will be returned or published to the “Dark Web.”

However, before we can be confident enough to stop paying ransoms, we must make sure that we can safely stop attacks and recover afterwards. For smaller, non-profit and under-resourced institutions we must make sure that enough support is available. This means more cooperation between providers, regulators, and state and local governments.

How Healthcare Organizations Can Secure Their Networks 

It is up to healthcare decision-makers and regulators to implement cybersecurity best practices across their organizations. As technology in the healthcare industry advances, so too must organizations’ approach to creating a more resilient and secure environment. Conversations about cybersecurity shouldn’t just happen after a breach exposes sensitive data and interrupts or halts delivery of service. These conversations should be ongoing. 

The first step leaders and regulators can take to secure their organizations is to adopt an “assume attack” mindset. Attacks are inevitable and it is up to organizations to either prepare for that inevitability or suffer the consequences. 

Additionally, it is critical that organizations implement a Zero Trust architecture to shore up their networks. A Zero Trust strategy comprises three steps:

1. Map out the systems, applications, and data you need to protect
2. Understand your organization’s status on the Zero Trust Maturity Model
3. Work on your organization’s priority pillars 

Healthcare leaders are not only responsible for securing their organization — but for ensuring the safety of the people for whom they provide essential services. It is time for regulators to provide a guide for best practices on how healthcare organizations can secure their environments to mitigate any of the physical harm that stems from interrupted services in the case of a breach. While creating these guides, factors such as the type of organization, size, budget, and resources need to be taken into account. 

Building cyber resilience to minimize the impact of breaches is key for healthcare organizations. Patient safety and quality care are the utmost important priorities, which means it is critical that organizations start investing in cybersecurity to protect patients’ wellness and their data. 

About Trevor Dearing

Trevor Dearing is the Director of Critical Infrastructure Solutions at Illumio and has been at the forefront of new technologies for nearly 40 years. From the first PCs through the development of multi-protocol to SNA gateways, initiating the deployment of resilient token ring in DC networks and some of the earliest use of firewalls. Working for companies like Bay Networks, Juniper, and Palo Alto Networks he has led the evangelization of new technology. Now at Illumio he is working on the simplification of segmentation in Zero Trust and highly regulated environments.