Majority of cyberattacks are through third-party vendors
Hospitals didn't have Change Healthcare on their radar as a risk when the ransomware attack affected them, says John Riggi.
Cybersecurity experts John Riggi and Richard Staynings speak at the HIMSS Healthcare Cybersecurity Forum.
Photo: HIMSSMedia
WASHINGTON, D.C. - The vast majority of cybersecurity risks and breaches are from third-party vendors and other organizations, said experts John Riggi and Richard Staynings during the closing keynote of the HIMSS Healthcare Cybersecurity Forum on Friday.
The numbers have grown from 27 million people affected in 2020 to the 150 million affected by the Change Healthcare ransomware attack in February, according to Riggi, former FBI special agent and national advisor for Cybersecurity and Risk, American Hospital Association.
Every hospital was affected, he said, which shows the interconnectedness of current technology.
In another example of how one system can affect millions of others, a faulty software update from cybersecurity firm CrowdStrike in July caused a global IT outage that affected millions of Windows systems and Microsoft devices across industries ranging from healthcare and banking to air travel.
Riggi said health systems and hospitals spend billions of dollars a year on preventing risk, but nowhere on their radar was the threat that a Change outage could cause.
Health systems need to protect against cyberthreats, the speakers said, but how can they control data shared beyond the four walls of the hospital?
"Who has our data?" asked Staynings, a professor at the University of Denver, a thought leader and self-proclaimed cybersecurity luminary and evangelist. "Is confidentiality even valuable today?"
Many cybercriminals are in Russia, the experts said.
Prior to Tuesday's presidential election, there's been a tremendous amount of disinformation being sent through phishing emails to sow doubt on the election and create distrust in the electoral process, Riggi said.
China employs cybercriminals, according to Staynings.
Beyond the risk of exposure of personal health information, cybersecurity attacks affect health and can be deadly, they said.
Cyberattacks can cause patient deaths even when the hospital has not been hit by an attack, according to Eric Liederman, speaking to HIMSSTV. Liederman is CEO of CybersolutionsMD and former National Leader of Privacy, Security, and IT Infrastructure, Kaiser Permanente.
A publication through the University of California San Diego showed the results of one hospital when a nearby system got hit by ransomware, Liederman said. Patient outcomes for serious illnesses such as cardiac arrest and stroke plummeted, going from a 50-50 chance of leaving the hospital alive to 10%. This was due to patients being diverted from the nearby health system, resulting in a huge increase in the volume of patients, he said.
Email the writer: SMorse@himss.org
