Why is healthcare the weakest link in cybersecurity defence
Data from Tenable showed that 35.4% of breach events in 2022 targeted the healthcare sector.
Healthcare institutions have been found to be the top target of cybercriminals. According to Tenable’s Threat Landscape report, the sector contributed to 35.4% of all breach events in 2022.
The year 2022 also marked the 13th consecutive year that the healthcare sector reported the highest data breach costs, with an average cost pegged at US$10.93m, according to IBM Security Cost of a Data Breach Report 2023.
Tenable’s report suggested that cybercriminals are targeting healthcare information given the slower pace at which providers are adopting “adopting preventive cybersecurity measures."
Given the alarming rise of cyberattacks in the sector and more institutions embarking on their digitising journeys, Tenable underscored that it has become more important for providers to strengthen their cybersecurity.
The report added that whilst stricter data-protection laws will be crucial in preventing cyber attacks, healthcare entities must not rely on the “bare essentials.”
“Whilst regulatory measures are essential, waiting for them might be detrimental. Healthcare organisations need to prioritise cybersecurity now,” the report stated.
Growing concern
According to the 2023 ForgeRock Identity Breach Report, the healthcare sector in Australia is the most vulnerable to cyberattacks, with the sector contributing 16% of all 890 data breaches in the market last year.
In 2022, Farrer Park Hospital in Singapore faced a $58,000 fine after its data was compromised, which resulted in forwarding almost 2,000 patients’ medical information to a third party.
Two months ago, another Singapore hospital, Fullerton Healthcare, was also fined with the same amount because it failed to implement safety measures to shield personal data of its corporate clients and patients.
In November last year, All India Insitute of Medical Sciences in New Delhi, India disclosed an IT outage following a suspected ransomware threat.
East Asian markets are also not strangers to cyber threats. Osaka Medical Center in Osaka, Japan was forced to shift to manual operations after it experienced a power outage caused by a ransomware attack on its electronic medical records (EMR) system, which is an online medical treatment history of patients.
Other possible questions for discussion:
- What immediate actions should healthcare institutions prioritise to safeguard their data?
- How can healthcare entities strike a balance between the rapid digitisation of services and ensuring robust cybersecurity measures?
- How can healthcare institutions regain and maintain the trust of the public, ensuring that their personal and healthcare data is safe?
- What role should private healthcare entities play in shaping these regulations to ensure both compliance and effectiveness against cyber threats?
- What cybersecurity factors should healthcare providers consider when choosing third-party vendors?
- What types of technologies should hospitals invest in to protect themselves against cyberattacks?
Read Here
Advertise
Sign Up
EXPERT OPINION
Healthcare data on the black market grows in value too, in part driven by the trend toward consumerization of healthcare products and services. That said, we mustn't remain frozen in fear or, even worse, regressive in our actions. Instead, there are opportunities to rise to the challenge:
1) Cybersecurity (and, relatedly, privacy) are becoming the bedrock standards for health data sharing. Such sharing will be able to unlock even greater value in our healthcare systems.
2) Innovators (in healthcare products and services) who take cybersecurity seriously are pulling ahead. Increasingly, funding, regulatory approval, and reimbursement are tied to data protection.
3) Whether reacting to an attack or proactively future-proofing healthcare data, cybersecurity dialogue offers a platform for multi-stakeholder collaboration. Including providers (public and private), pharma/device companies, tech firms, start-ups, governments, and regulators, across borders.
Most importantly, cybersecurity represents a leadership and capability opportunity for the next generation of healthcare professionals.
Shin Thant Aung, Director, YCP Thailand
"The cyberattacks in healthcare organizations are increased more than 50% in 2022, compared to 2021, averaging around 1,400 cyberattacks per week. However, there is an alarming surge of cyberattacks in Southeast, including Thailand over the last half year of 2023"
"Thailand is a country where there is nearly doubled the rate of average global cyberattacks per week, comparing 2,388 cyberattacks in Thailand compared to 1,400 around per week in global country average"
"There was a notorious case in Thailand, where hackers demand 200,000 bitcoins ransom from the hospital for the medical files."
"Immediate action in healthcare cybersecurity means a three-pronged approach: risk assessment, multi-factor authentication, and staff education. Don't underestimate the power of a well-informed employee, which is attacked by cybersecurity."
"With the recent PDPA effective in Southeast Asia Countries, including Thailand, these hospitals have extensive responsibilities in controlling the personal data files of patients. Most cyberattacks are attacking on SEA healthcare system as most hospitals and organizations don't have well-equipped security systems and most public knows about it. Therefore, rebuilding public trust in healthcare organizations for protecting sensitive data and patients' privacy are important."
"The cyberattacks are aiming at healthcare organizations and hospitals because of the valuable data, limited cybersecurity resources, lack of cybersecurity awareness and etc. These can be controlled by risk assessment and management, training, network, endpoint and email security in the future."