Healthcare cyberattacks are costing an average of $11 million per breach

Photo: sestovic/Getty images

The global healthcare sector experienced a staggering 1,613 cyberattacks per week in the first three quarters of 2023, nearly four times the global average, and a significant increase from the same period the previous year, according to a KnowBe4 report.

This surge has contributed to a steep rise in cyberattack costs for healthcare organizations, with the average breach cost nearing $11 million – more than three times the global average – making healthcare the costliest sector for cyberattacks.

Ransomware attacks have dominated, accounting for over 70% of successful cyberattacks on healthcare organizations in the past two years.

Phishing and social engineering tactics are the primary methods used to initiate the majority of cyberattacks, with estimates suggesting that 79% to 91% of attacks begin this way.

The report noted employees in large healthcare organizations have a 51.4% likelihood of falling victim to phishing emails, giving cybercriminals a better than even chance of successfully breaching these institutions.

"Healthcare is already expensive, partly due to the cost of equipment and consumables needed to diagnose and treat illnesses and injuries," said Erich Kron, security awareness advocate at KnowBe4. "Paying a multi-million-dollar ransom, plus the cost of a security team brought in for incident response, is a significant outlay of funds."

He added this is especially true given the huge size of modern healthcare systems that may be connected across the country.

WHY THIS MATTERS

Healthcare organizations collect and process a huge amount of sensitive data – and cybercriminals know it.

The risk of regulatory fines and lawsuits related to the leakage of this information is monumental, which allows attackers to leverage the risk to demand large ransoms.

The healthcare industry is also very computer-driven, with a huge number of network-connected devices and computer systems online at any time.

"After an attack, it is critical to make sure these devices do not contain backdoors or other malware that will allow attackers to reinfect the network again in the future," Kron said. "This all takes time, skills and money to accomplish."

He added the sheer volume of attacks on something as critical as healthcare, combined with the extremely high click rates in the industry, paints an unfavorable picture for the future of healthcare data.

"Not only is data at risk, but healthcare workers are also often overwhelmed with patient loads and the loss of technology further burdens them, possibly to the point of breaking," he cautioned. "This could result in dangerous mistakes being made, not out of malice or carelessness, but out of exhaustion."

THE LARGER TREND

Change Healthcare, Ascension and Kaiser Foundation Health Plan are among the most recent targets of far-reaching cyberattacks, the fallout from which is likely to continue even as new breaches arise.

Kron said with attacks becoming more common – and apparently more damaging – healthcare organizations need to take a focus on cybersecurity in the same way they focus on safety.

"At the end of the day, a successful ransomware attack is a safety concern for the patients and employees and must be treated as such," he said.

KnowBe4, based in Clearwater, Florida, offers security awareness training and simulated phishing platforms. It is used by more than 65,000 organizations worldwide, according to the company.

From Kron's perspective, it is critically important that healthcare organizations look closely at their specific risks and develop a plan to address them.

"Not every organization is the same, so the critical risks may vary from place to place and it is important to not spend financial and human resources addressing low-risk items," Kron said.

He explained a focus on human risk is important – most ransomware attacks start with a phishing email directed at an employee. "It is also relatively low-cost and can be tied in many ways to existing safety programs," he said.

The goal is to improve the security culture of the organization in the same way to make sure employees think about keeping patients safe.

In addition, healthcare organizations should have robust incident response plans in place and should test them often.

Kron explained many organizations have found themselves unable to make decisions, figure out processes, or contact key decision-makers while dealing with an incident.

"A lot of time that could be used to stop the spread of malware or start recovering is wasted while figuring out what to do next," he said. "A solid plan that is tested is invaluable in these situations."  

Email the writer: nathaneddy@gmail.com

The HIMSS AI in Healthcare Forum is scheduled to take place September 5-6 in Boston. Learn more and register.