In 2020, the Dental Care Alliance (DCA) skilled a big cyberattack on its techniques, which lasted roughly a complete month. This gave the risk actor an prolonged interval to compromise the healthcare group’s servers and extract the non-public and confidential info of round a million sufferers.
That is simply one other instance of how weak the healthcare trade is to cyber criminals trying to exploit safety weaknesses. Healthcare organizations are prime targets for risk actors who’re absolutely conscious that their targets are invested in holding their techniques and companies up and working effectively and securely. That is particularly important in defending affected person privateness and information, significantly in the case of impacting life-saving info and gear.
The incident
The cyberattack on the DCA was launched between Sept. 18 and Oct. 11, 2020. In the course of the month of the breach, a cybercriminal was capable of entry numerous confidential recordsdata, together with affected person information equivalent to names, contact particulars, remedies, diagnoses, affected person account numbers, their dentist’s names in addition to billing particulars and medical health insurance information. In 10 % of the instances, checking account numbers additionally had been compromised, making this the second-largest reported assault that yr.
The assault resulted in a class-action lawsuit, which resulted in a $3 million settlement towards the DCA. The DCA was accused of negligence for its failure to guard and preserve its techniques and infrastructure towards breaches, and for failing to implement correct safety monitoring. It additionally was cited for neglecting to improve its safety measures and to implement correct cybersecurity {hardware} and software program, in addition to adequately prepare its workers. Because of this, sufferers feared an elevated threat of fraud.
Whereas it was not publicized how the attacker gained preliminary entry to the corporate’s community, plaintiffs argued that it was the DCA’s poor cybersecurity practices that uncovered them to the danger of id theft and fraud.
Sadly, this isn’t the one case during which a corporation has been sued over alleged negligence. Eye Care Leaders was accused of concealing multiple ransomware attacks in 2021, which resulted in a provider-led lawsuit. Not solely does this spotlight the frequency of assaults on healthcare organizations, nevertheless it additionally underscores the immense value that’s related to failing to grasp threat and supply ample cybersecurity protocol and measures. Only a single safety incident can result in reputational injury and important monetary losses. That is additional exacerbated by the implications of breaches of confidential affected person and consumer info.
Each instances are home windows into the high-stakes cyber threat panorama for healthcare suppliers and payers, significantly in the case of a corporation’s being fined by the federal authorities for HIPAA violations.
Cyber threat in healthcare
In 2021 alone, the healthcare trade was hit with 849 cyber incidents, with 571 of those confirmed that non-public information had been accessed, in line with the Verizon Data Breach Investigations Report. This positioned healthcare in eighth place for industries focused by assaults, and in third place for variety of information breaches, out of a complete of 21 classes within the Verizon report.
Through the use of previous cyber occasions and parameters equivalent to income, variety of workers and variety of database data, it’s doable to estimate a quantified worth of threat to which corporations are uncovered. Through the use of benchmark values, one can deduce that the healthcare trade exhibits comparatively larger charges of reported breaches compared to different sectors (although that’s partially pushed by stronger information privateness insurance policies and required reporting for smaller incidents to satisfy federal laws). There’s a 9.3 % general chance of an annual incident focusing on this trade.
The chance of incidents occurring in a yr and the estimated value by threat class inside healthcare is as follows:
- Insider Error: Chance: 29.95 %, value: $73.6 million
- Insider Misuse: Chance: 24.99 %, value: $47.2 million
- Fundamental Net Utility Assaults: Chance: 9.19 %, value: $42.1 million
- System Intrusion: 4.83 %, value: $5.4 million
- Social Engineering (Phishing, and so on.): Chance 3.80 %, value: $6.6 million
- Denial of Service (DoS): 2.19 %, value: $7.5 million
- Ransomware: 3.85 %, value: $929.9 thousand
In quantifying the danger, healthcare organizations can higher calculate their threat urge for food and allocate spending extra effectively to bolster safety the place wanted. This not solely will enhance general cybersecurity, it additionally will scale back wasted spending on defending infrastructure that isn’t as weak or might not want as sturdy measures as different areas.
Bolstering cybersecurity
With a purpose to stop falling sufferer to a cyberattack and keep away from being entangled in expensive lawsuits, organizations ought to foster a robust cybersecurity tradition and pay attention to the danger to which they may very well be uncovered in addition to the potential worth related to it. In addition to increasing overall visibility over gadgets on and connections to the community, increasing cyber risk consciousness coaching for employees and implementing multi-factor authentication, organizations ought to know their threat.
What does this imply? Understanding threat can finest be executed by quantifying its worth. Through the use of a global normal, equivalent to FAIR (Issue Evaluation of Data Danger™), organizations can estimate their threat financially, which permits them to higher implement cybersecurity methods in line with the place larger threat exists. They will allocate budgets and perceive their threat urge for food extra totally because it permits them to see how a lot totally different dangers might value the enterprise.
In the end, quantifying threat would enable organizations to grasp what’s at stake and to arrange and make investments accordingly.
About Bryan Smith
Bryan Smith is the CTO of RiskLenswhich helps organizations make higher cybersecurity and expertise funding choices with software program options that quantify cyber threat in monetary phrases. Smith is a broad technologist with over 20 years of software program engineering expertise. His experience contains constructing enterprise scale net purposes, cybersecurity, and large information. Smith led the event of RiskLens’ enterprise cyber threat quantification and administration platform. Previous to RiskLens, Smith helped construct the nation’s first digital archives enabling it to scale 3400% over 5 years.
Writer: Bryan Smith, Chief Know-how Officer, RiskLens
Date: 2023-05-10 00:00:00
