In last week’s National Cybersecurity Awareness Month (NCSAM) post, Hagerty discussed common cyber-attacks as well as the rise in individual and organizational cyber risk during this unprecedented year, and how individuals can improve their personal and professional cyber hygiene. Similarly, the healthcare sector has faced additional challenges and an uptick in cyber incidents in 2020.
<h2>COVID-19, HEALTHCARE, AND CYBER-CRIME</h2>
While cyber threats to the healthcare industry are not new, the COVID-19 pandemic and its impacts on individuals and organizations has increased the cyber risks for healthcare systems. The influx of new internet-connected devices (e.g., medical systems, equipment, sensors), unmanaged personal devices, and remote access points in healthcare facility networks <a href="https://cyber.nj.gov/alerts-advisories/cyber-threats-cybersecurity-for-healthcare-during-covid-19" target="_blank" rel="noopener noreferrer">increase their attack surface</a> and vulnerabilities for attackers to exploit. Malicious actors are also using COVID-19 as the ‘lure’ for a <a href="https://thehill.com/policy/cybersecurity/493410-hospitals-brace-for-increase-in-cyberattacks" target="_blank" rel="noopener noreferrer">growing number</a> of <a href="https://us-cert.cisa.gov/ncas/tips/ST04-014" target="_blank" rel="noopener noreferrer">phishing</a> attempts. Additionally, COVID-19 may also provide additional incentives for cyber criminals and other adversaries to target healthcare facilities and systems.
<img loading="lazy" decoding="async" class="aligncenter size-large wp-image-6707" src="http://hagertystg.wpengine.com/wp-content/uploads/2020/10/Screen-Shot-2020-10-20-at-5.08.48-PM-1024x671.png" alt="" width="640" height="419" />
COVID-19 Screening Tool: <a href="https://unsplash.com/photos/-9_6ymUJvPU" target="_blank" rel="noopener noreferrer">Source</a>
In particular, attackers are increasingly using ransomware to target hospitals and other healthcare facilities. <a href="https://us-cert.cisa.gov/security-publications/Ransomware" target="_blank" rel="noopener noreferrer">Ransomware</a> is a form of malware that infects and restricts access to computers and data until or unless the targeted organization pays the attacker a ransom. In the healthcare sector, these attacks can impact information technology (IT) systems, patient data, medical response, and patient safety. Between July and October 2020, the daily average number of ransomware attacks across all sectors in the United States (US) was up by <a href="https://blog.checkpoint.com/2020/10/06/study-global-rise-in-ransomware-attacks/" target="_blank" rel="noopener noreferrer">98 percent</a>. One sophisticated Ransomware variant known as <a href="https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/" target="_blank" rel="noopener noreferrer">Ryuk</a> is affecting the healthcare industry <a href="https://blog.checkpoint.com/2020/10/06/study-global-rise-in-ransomware-attacks/" target="_blank" rel="noopener noreferrer">more than any other sector in the US</a>.
Some recent examples of cyber-attacks on healthcare systems highlight this trend.
<ul>
<li>Ransomware Attack on Large US Hospital Coalition: In September 2020, attackers hit <a href="https://techcrunch.com/2020/09/28/universal-health-services-ransomware" target="_blank" rel="noopener noreferrer">Universal Health Services</a>, which operates nearly 70 acute care and outpatient facilities nationwide, locking down servers and phone lines across associated hospitals and potentially exposing significant amounts of patient data and personally identifiable information. This attack follows dozens of <a href="https://www.beckershospitalreview.com/cybersecurity/healthcare-providers-that-underwent-cyberattacks-in-2020-so-far.html" target="_blank" rel="noopener noreferrer">similar incidents</a> across the US.</li>
<li>Lethality of Ransomware Attacks on Healthcare Facilities: A ransomware <a href="https://apnews.com/article/technology-hacking-europe-cf8f8eee1adcec69bcc864f2c4308c94" target="_blank" rel="noopener noreferrer">attack</a> targeting a German university which affected its hospital was the first in which a patient’s death was attributable to a cyber-attack. However, studies suggest that hospitals impacted by ransomware typically face an <a href="https://www.businessinsider.com/cyber-attacks-hospitals-rise-in-heart-attack-deaths-study-2019-11" target="_blank" rel="noopener noreferrer">uptick</a> in patient mortality &#8211; even if the effects are indirect.</li>
<li>Attacks on Other Healthcare Systems: In addition to hospitals, other healthcare organizations <a href="https://www.interpol.int/News-and-Events/News/2020/Cybercriminals-targeting-critical-healthcare-institutions-with-ransomware" target="_blank" rel="noopener noreferrer">at the forefront of the global response to COVID-19</a> have fallen victim to cyber-crimes, including <a href="https://www.nytimes.com/2020/10/03/technology/clinical-trials-ransomware-attack-drugmakers.html" target="_blank" rel="noopener noreferrer">companies</a> involved in clinical vaccine trials and development of rapid testing capabilities.</li>
<li>Attacks on Supply Chains: Attackers have also targeted the <a href="https://isc.sans.edu/diaryimages/Kwampirs_PIN_20200330-001.pdf" target="_blank" rel="noopener noreferrer">supply chains</a> for healthcare companies’ software and hardware products, including products used to manage industrial control system assets and patient information in hospitals.</li>
<li>Emerging Ransomware Tactic: A new ransomware tactic is emerging called “<a href="https://research.checkpoint.com/2020/ransomware-evolved-double-extortion/" target="_blank" rel="noopener noreferrer">double extortion</a>,” in which attackers extract large quantities of sensitive commercial data before encrypting the victims’ databases, threatening to leak it unless the ransom is paid. This approach is an attempt to circumvent the use of frequent backups that companies can restore to as a common defense against ransomware.</li>
</ul>
<h2>WHY HEALTHCARE SYSTEMS</h2>
The healthcare sector is not merely being caught in the crossfire of normal cyber activity; attackers are <a href="https://www.forbes.com/sites/daveywinder/2020/04/08/cyber-attacks-against-hospitals-fighting-covid-19-confirmed-interpol-issues-purple-alert/#5b792aec58bc">choosing these targets </a>because they believe the pandemic has increased healthcare facilities’ incentives to acquiesce to ransom demands. COVID-19 has increased intake rates, heightened patient load, and burdened intensive care unit (ICU) capacity in health systems worldwide. With this increased operating demand, attackers see an opportunity to extort hospitals and other healthcare facilities for a more significant and/or quicker payment.
<h2>CONSIDERATIONS FOR HEALTHCARE SYSTEMS</h2>
There are important steps that individuals and organizations in the healthcare sector can take to reduce and mitigate cyber threats. Hagerty has identified four important pillars to help organizations #BeCyberSmart:
<img loading="lazy" decoding="async" class="aligncenter size-large wp-image-6708" src="http://hagertystg.wpengine.com/wp-content/uploads/2020/10/Screen-Shot-2020-10-20-at-5.16.09-PM-1024x580.png" alt="" width="640" height="363" />
<ul>
<li>Ensure Employee Awareness: Employees at hospitals and other healthcare facilities need to be able to identify and avoid phishing attempts and other tactics, techniques, and procedures that attackers use to gain access into their organization’s networks. Companies can help ensure their staff are prepared by conducting training and occasional testing.</li>
<li>Secure Networks and Devices: As hospitals and other healthcare facilities continue to adapt to teleworking and telemedicine, it is important to ensure that any changes to their network infrastructure and connecting new devices into their network is done with extreme vigilance. Where possible, the use of managed devices instead of connecting employee devices can reduce the risks to company networks. Segregating corporate/IT networks from operational technology networks can also help healthcare providers limit the impacts of potential network breaches.</li>
<li>Practice Cyber Hygiene: Basic cyber hygiene <a href="https://hagertyconsulting.com/about-us/blog/do-your-part-be-cybersmart-how-cyber-hygiene-can-protect-you/" target="_blank" rel="noopener noreferrer">best practices</a> can help secure healthcare organizations against attack. The National Institute for Standards and Technology (NIST) <a href="https://www.nist.gov/cyberframework/online-learning/five-functions" target="_blank" rel="noopener noreferrer">Cybersecurity Framework</a> and associated standards and best practices provide a valuable starting point. Adhering to least privilege access controls, keeping software up to date, and frequent backups can go a long way in securing against ransomware and other malware.</li>
<li>Strengthen Incident Response Planning: Even with proper protections in place, organizations may still fall victim to a successful cyber-attack. Companies should ensure they are prepared for such a worst-case scenario. By developing an incident plan that clearly roles and responsibilities, processes and procedures, triggers and thresholds, and other aspects of incident response, companies can minimize the impact that a successful cyber-attack will have on their organization. Exercising these plans can further improve response capabilities.</li>
</ul>
<h2>HAGERTY CAN HELP</h2>
Hagerty has the experience and expertise to support organizations in cybersecurity preparedness efforts, as well as pandemic planning, business continuity, and Continuity of Operations (COOP). We stand ready to help with your organization’s assessment, planning, training, and exercise needs to enhance cybersecurity and emergency response strategies amid the evolving COVID-19 pandemic response. To learn more about our cybersecurity service line, contact us or visit our <a href="https://www.cyberthreatready.com/" target="_blank" rel="noopener noreferrer">cybersecurity microsite</a> to utilize our free <a href="http://hagertystg.wpengine.com/wp-content/uploads/2017/10/Cyber-Incident-Assessment-Tool_HagertyConsulting.pdf" target="_blank" rel="noopener noreferrer">Cybersecurity Assessment Tool</a> that will evaluate your current cyber capabilities.
<hr />
<a href="https://www.linkedin.com/in/robdenaburg/" target="_blank" rel="noopener noreferrer">Rob Denaburg</a> is a Senior Managing Associate in Hagerty’s Preparedness Division. Rob is new to Hagerty but has worked with public and private sector clients to minimize the societal, economic, and national security impacts of infrastructure outages. In a previous role, he advised policymakers and industry leaders on how to build resilience against severe natural and manmade hazards, especially sophisticated cyber-attacks on lifeline systems.
<a href="https://www.linkedin.com/in/ruthanneholiday/" target="_blank" rel="noopener noreferrer">Ruth Anne Holiday</a> is a Managing Associate at Hagerty, supporting both the Preparedness and Recovery Divisions. Ruth Anne was instrumental to Hagerty’s Long-Term Recovery Planning support for the City of Panama City, developing the City’s Unmet Needs Assessment which quantified Hurricane Michael’s impact on the community. Ruth Anne serves on the Situational and Status Blog Team, providing timely updates on major events and disasters impacting communities around the nation. Prior to Hagerty, Ruth Anne supported community-building preparedness initiatives and COOP activities, exercise and workshop development, and strategic recovery planning.

Do Your Part, Be Cybersmart: Healthcare Systems See Increased Attacks With COVID-19

Steve Hagerty Selected for FEMA’s Vanguard Executive Crisis Leaders Fellowship

Bird Flu and Beyond: Preparing Our Nation’s Healthcare System

Preparing for Increasing Climate-Driven Hazards

The Hagerty Advantage – Our People: Jessi Widhalm, Tori Abbott, Meagan Flanagan, and Joely Bertram

Blizzard Conditions Impact The West Coast While Record Breaking Wildfires Affect The Texas Panhandle

Migrant Arrivals: Local and State Response and the Role of Emergency Management

Atmospheric River Brings Extreme Flooding, Winds, and Mudslides to California

The Hagerty Advantage – Our People: Andrew Bohnert, Marina Conner, Harrison Newton

Extreme Winter Weather Continues To Impact Nearly 80 Percent Of The US With More Winter Storms To Come

Extreme Winter Storms Impacting Large Portions the US with More Severe Weather on the Way this Weekend