As Data Breach Reports Surge, Healthcare is the Most Hit Sector

Posted by Selina Coen on Tue, Aug 29th, 2023

Cybercriminals are always looking for their most lucrative target, and healthcare has proven to be one of the biggest moneymakers in recent years. Healthcare providers store valuable data, but they often need to improve how to handle this data using cybersecurity best practices. What makes healthcare data breaches more dangerous for providers is the aftermath of a data breach. Patients lose sensitive information to attackers, and the organization suffers from class-action lawsuits and regulation violations based on HIPAA (Health Insurance Portability and Accountability Act) non-compliance.

Why is the Healthcare Industry a Primary Target for Hackers?

Every industry is a target, but healthcare’s massive data storage and limited cybersecurity resources have made it a better target than others. A technology company, for example, might have more money to steal, but they also have better cybersecurity resources. Healthcare –and finance, for that matter -- is notoriously slow to adopt changes to their infrastructure, including cybersecurity assets.

Hospitals and healthcare facilities heavily rely on Internet of Things (IoT) for patient care. While IoT offers numerous benefits to patients and healthcare workers, it expands an organization’s attack surface and often introduces unknown vulnerabilities to operations administrators. They should be scanned for vulnerabilities, but administrators might be unaware that they create the potential for a data breach.

Legacy applications are often present in a hospital environment, and users don’t have the cybersecurity training to detect phishing and social engineering. If legacy applications are no longer supported and they do not receive regular updates, they often have security flaws that persist on the network. Any deprecated application should be replaced, but it’s much easier said than done in a large hospital or healthcare facility.

All healthcare staff should be trained to detect phishing and social engineering, but phishing continues to be lucrative for cyber-criminals. Employees with access to patient data or connected to the environment are perfect targets for phishing and ransomware, often used to exfiltrate data from a healthcare provider. Ransomware can then be used to extort money from healthcare providers without effective disaster recovery plans.

Healthcare Data Breaches for 2023

Every year, the cybersecurity landscape changes, but something that remains the same is the significant data breaches that hit specific industries. Because the healthcare industry is a primary target, it represented many data breaches in the first half of the year. For example, PharMerica suffered from a data breach where almost 6 million patients were affected. MCNA Dental also suffered a data breach involving nine million patients when hackers accessed their sensitive information.

As of the publication of this report, 2023 has six more months of opportunity for hackers to make newsworthy exploits on large healthcare companies, but it’s not too late for healthcare organizations to take the necessary steps to stop them. Data breaches in the healthcare industry are increasingly more severe, and millions of individuals across the globe are affected. Identity theft, phishing, social engineering, and other future attacks are possible when sensitive data is disclosed to third parties, especially when the third parties intend to sell the data on darknet markets.

What Can Healthcare Organizations Do to Combat Hackers

Hackers continue to increase their stealth and capabilities as more cybersecurity protections are introduced to enterprise organizations. Focusing on the human element working within organizations is much more effective than traditional bypasses and exploits against infrastructure. This strategy poses a significant challenge for healthcare organizations with the best cybersecurity infrastructure but lacks employee security awareness training.
Cybersecurity strategy best practices involve several overlapping layers that protect data and infrastructure but do not act as a sole defense. Every organization needs security layers, so hackers must bypass several protection layers before gaining access to data. The first layer of defense should always be email server cybersecurity, which protects user inboxes. 

An email filtering solution analyzes incoming messages, uses artificial intelligence and heuristics to identify potentially malicious activity, and quarantines the message if it’s suspicious or passes it to the recipient’s inbox if it’s considered harmless. Attachments are also analyzed and processed to protect recipients from opening files with malicious macros and scripts used to download malware.

Any cybersecurity solution should have minimal false negatives, but false negatives are always possible. The best email filtering software occasionally allows for a few sophisticated phishing emails to pass to the intended recipient. Layered security strategies handle this phenomenon with employee training. Security awareness training such as those offered by TitanHQ SafeTitan empowers employees to identify and stop email threats.

Security awareness training offers failover in the rare cases when email filters fail to detect an active threat. Employees with the proper training evaluate the content, look at the sender, and ask questions before acting. Pushing employees to feel a sense of urgency is part of a sophisticated email-based threat, so security awareness training teaches employees to stop and think and never act based on an email message that claims speed is necessary.

Email filters and security awareness training aren’t the only protections but are an excellent first line of defense. Antivirus programs should always run on the user’s machine. HIPAA requires all machines to have antivirus programs installed, so a data breach from antivirus failure could increase costs from the compromise. Antivirus programs should never be the first line of defense but instead a final failover. Relying solely on antivirus programs means the software must detect the malware and its payload before installing it on the local machine. Still, by then, the malicious content has reached its intended target.

A combination of employee cybersecurity training, email filters that stop malicious messages from reaching the intended recipient’s inbox, and antivirus programs is the best solution for any industry. Still, healthcare organizations should be primarily motivated to implement suitable measures. 

TitanHQ has several solutions for layered protection for the healthcare industry’s environment. Protect your organization from phishing, data loss, drive-by malware installation, and social engineering. TitanSecure is a triple-layer threat protection solution, including SpamTitan for protection against phishing, WebTitan for protection against web content-based threats, and ArcTitan for data archiving and backup protection.

To get started, sign up for a free trial today.