Table of content:
Why is the Healthcare Industry Often Targeted by Phishing Attacks?
Examples of Famous Healthcare Data Breaches
How to Avoid Phishing Data Breaches?
In 2021 alone, over 22.6 million patient data was affected by healthcare-related data breaches. The healthcare industry has recently become one of the most heavily affected industries by cyberattacks. In particular phishing related attacks that are delivering ransomware. Ransomware is malware that encrypts company systems to disturb business operations. This article will discuss how the healthcare industry is being affected by phishing attacks to cause healthcare data breaches.
A phishing attack is a type of social engineering attack that seeks to trick people into performing a malicious action, like clicking on a link or downloading a malicious attachment. Phishing attacks are often carried out via email, one of the most effective cyberattacks. Some people estimate that as much as 90% of data breaches occur due to phishing attacks, making it one of a business's most prevalent cybersecurity risks.
A healthcare data breach is anytime that unauthorized users access company data. This can be due to a cyber-attack, employee error, data leaks from malicious insiders, or any number of causes. The vital thing to note is that data breaches are incredibly costly to a company in terms of money and time. According to IBM, the average data breach in the United States costs over $4 million, and it takes roughly 197 days to identify a data breach and 69 days to contain it. As a result, companies need to invest in preventing these types of incidents to avoid this type of cost. However, for some companies, it's much more complex than others, with healthcare being one of the most heavily targeted industries in the world.
Companies in the healthcare industry are one of the most heavily targeted by cybercriminals because it's one of the most profitable industries for computer hackers. Healthcare information sells more than financial information, Personally identifiable information, and is by far the most profitable type of information traded by hackers. Also, because many healthcare providers are critical to the health of their patients, they can't afford to be out of business as long as other companies. This makes them a prime target for malware attacks like ransomware, where hackers will encrypt all of the information on the victim's network and attempt to coerce the business into paying a ransom to restore business operations. As a result, hackers like to target the healthcare industry, and one of the most common ways they will do this is via a phishing campaign.
To better illustrate how big of an issue this is, let's look at some of the biggest healthcare data breaches that have occurred in the last few years:
OneTouchPoint: This company is a healthcare provider that provides printing and mailing marketing services for health insurance carriers and other medical providers. Altogether, OneTouchPoint gathers patient data from roughly 34 different healthcare providers. They suffered a data breach in July 2022 that affected roughly 2,651,396 individuals. The information included names, member IDs, and the information gathered during health assessments.
Eye Care Leaders: This company is a leader in ophthalmology-specific EMR solutions and suffered a data breach in December 2021. The exact statistics of this breach were not clearly defined, but it's estimated that over 2,000,000 individuals were impacted. The compromised information included patient names, phone numbers, addresses, emails, driver's licenses, health insurance information, medical record numbers, and social security numbers.
Novant Health: This healthcare provider suffered a data breach due to a misconfiguration in the meta pixel code that led to a data breach of roughly 1.3 million patients. For those unfamiliar, a meta pixel is a piece of Javascript code that tracks user activity. Due to a misconfiguration, data was being sent out from the company to Facebook, which led to a huge breach of patient data.
Avoiding a data breach requires having multiple security controls implemented to prevent unauthorized access to your company's computer systems. Here, are some tips for defending against phishing attacks:
Email Security: The best thing you can do to protect your company from phishing emails is to invest in an email security solution that can scan emails for any signs of malicious attachments, links, or patterns associated with scams. This way, you can limit the number of emails your employees will come across that tempt them to perform an unsafe action.
Security Awareness Training: Another good measure is regular security awareness training to help your employees stay updated on identifying and handling potential phishing emails.
Network Segmentation: Good network segmentation helps limit the damage done by a malware infection caused by someone downloading malware.
Zero Trust Model: In a zero-trust framework, all users within the network are continuously required to be authenticated and authorized to access company resources. There is no traditional network boundary in a zero trust, as all users/identities are treated with suspicion. This can help to limit the damage done by someone that compromises a user account via a phishing email.
Anti-Malware Solutions: Lastly, you should have anti-malware solutions on all of your endpoints that can detect and block the download of malware to your computer systems. They should also periodically scan the machines for any malware that may have been downloaded, quarantine them and ultimately remove them.
Healthcare is one of the most heavily targeted industries regarding cyberattacks. The reason is that healthcare has some of the most valuable types of information in existence. As a result, we have seen healthcare data breaches that include over 2 million patents per data breach. To prevent attacks like this, we gave five tips for preventing data breaches in your company. We recommend that you check out Sealit's cybersecurity solutions for the healthcare industry for more information on how to protect your company.