Report identifies phishing and ransomware attacks as top security incidents for healthcare


The HIMSS Healthcare Cybersecurity Survey found that overall, healthcare organizations identified phishing and ransomware attacks as the most significant security incidents in 2021.

Financial information was the most frequent target of these cyberattacks, according to the report. Cyber ​​threats such as ransomware attacks against the industry have grown over the years amid the challenges it already faces: aging infrastructure and tight budgets.

The report, sponsored by Carahsoft, surveyed 167 professionals to assess the state of healthcare cybersecurity. Of those surveyed, 54% worked for healthcare provider organizations, 28% for consultancy/provider organizations, and 19% for other types of organizations. Most (61%) of respondents had primary responsibility for cybersecurity programs in their respective healthcare organization and 23% had some responsibility. Additionally, of those surveyed, 90% said they have a management role in healthcare cybersecurity.

A significant number (67%) of those who responded said that in the past 12 months their health facility had struggled significant security incidents, according to the report. When considering the severity of the security threat facing the organization, 12% rate it as critical and 32% rate it as a high threat.

Additionally, healthcare organizations have said a phishing attack were the most common first form of threat, 45% of security incidents. Ransomware attacks rank second, accounting for 17% of incidents.

Additionally, phishing has often played a major role in security incidents. For example, 57% of respondents said the most significant security incident was phishing. Respondents indicated the percentage of each type of phishing that occurred: email phishing (71%), Phishing (67%), voice phishing/vishing (27%), whaling (27%), business email compromise (23%), SMS phishing (21%), phishing websites (20%) and social media phishing (16%), according to the report.

When exploring the initial point of contact that compromised cybersecurity, phishing was most common, at 71%, according to the report. Additionally, human error (19%) and social engineering (15%) along with legacy software (15%) were the most common initial points of compromise, according to the report.

As a result, the study recommended that healthcare companies implement security awareness programs as well as insider threat detection and mitigation to improve security in the future. Additionally, the report recommended updating the software or completely replacing it when needed.

Regarding the target of attacks, the 2021 report mirrored the findings of the HIMSS 2020 report, with financial information being the main target 52% of the time, followed by employee information (43%) and patient information. (39%). . Intellectual property was the focus only 15% of the time, according to the report.

The attacks had various impacts, ranging from data breaches and leaks to system/device disruptions and financial loss. However, 44% of the time, the impact was non-existent or negligible.

The study also looked at healthcare companies’ cybersecurity budgets. While 40% of companies only allocate 6% or less of their budget to cybersecurity, 59% indicated an increase in their cybersecurity budget starting in 2020.

Additionally, budget, staff compliance with policies and procedures, legacy technology, as well as patch and vulnerability management were the top security challenges, according to the report.

A large majority (73%) said their healthcare organization had legacy operating systems. For example, 35% are using Windows Server 2008 and 20% are still using Windows XP. Surprisingly, 19% are using systems nearly 20 years old: Windows Server 2003 and 2003 R2, according to the report.

To address these vulnerabilities, healthcare organizations can implement various security measures. The report recommends that companies take stock of their current risks and address weaknesses, prioritizing this task in their budgets and training their employees on security measures. Failure to take these steps could result in potential violations in the future.

Photo: WhataWin, Getty Images; Graphics: HIMSS Healthcare


Comments are closed.