Hospitals, clinics, and dispensaries are centers of medical assistance that take care of people to maintain their health status, so they are an important organ in the societies of each country.
Attackers and entities with unlawful objectives make healthcare their target to breach their systems and get what they want, knowing that these entities play a vital role.
Cybercriminals targeted healthcare entities several years ago with the intent of obtaining money. They created the context of the attack to exploit the fact that healthcare facilities are responsible for protecting patients’ lives. If a patient’s life is at risk, the best course of action is to pursue the option that will preserve their life or result in the least negative or permanent effects.
Cyber attackers targeted healthcare facilities because they perceived them as organizations that prioritize the welfare of their patients and may be willing to pay to protect them. Additionally, the lack of budget for IT systems in these facilities made them vulnerable to attacks and unable to protect patients’ medical information effectively.
Considering these reasons is why healthcare centers have become a fixed target for many groups of attackers when requiring money for some illicit action they want to orchestrate later. Due to this, hospitals must make difficult decisions when faced with a ransomware attack, as these attacks can create a virtual nightmare for healthcare centers. Hospitals often pay the attackers instead of trying to stop the attack and minimize the harm to their systems.
Paying the ransom in a ransomware attack does not provide a solution for those impacted. It also does not deter the attackers from continuing their attacks, and they may even target the same hospital again. Robert Anderson Jr, CEO, and Chairman of Cyber Defense Labs, comments on this issue.
“I dealt with bad guys for 30 years, I know how they think. If they can burglarize your house and come back five more times without getting caught, they are going to do it.”
Therefore, protecting the systems managed by the healthcare sector is increasingly important as they are related to the lives of many individuals. While some healthcare centers with limited resources may find it necessary to give in to ransomware attacks, it raises questions about where these organizations are allocating their budget. It is not simply a matter of hiring the best technology to continue the scientific advancement of health in the human body. With these acquisitions come a growing number of vulnerabilities, which, if not considered or ignored, can be exploited and compromise many lives that depend on this technological health equipment.
Considering actions such as improving cybersecurity aspects in the healthcare sector, as well as applying good practices, including the most basic and important ones, such as backups, is vital. An example of this is an experience that Emory Healthcare (EHC) had five years ago. A spokesperson for the hospital explained that they did not agree to pay for the compromised data because they had a complete backup than what the attackers had obtained.
These types of practices prevent a broader scope of attacks and limit the actions that cyber attackers can take against healthcare facilities, which need to be strengthened and educated in the aspect of Cybersecurity for the benefit of all their departments, systems, and patients.
