Report: Most Common Cyberattacks Faced by Healthcare Organizations

A recent report from Proofpoint provides insights into the most common attacks faced by healthcare organizations. To help better understand the evolving cyberthreat landscape, the report analyzed a year of cyberattacks against healthcare providers, pharmaceutical and life sciences organizations, and health insurers between 2018-2019.

One key trend noted throughout the report suggests that today's cyberattacks are targeting people, not just infrastructure and technology. Attackers are exploiting the human factor by impersonating staff members, instructing them to wire money or sensitive information, and tricking healthcare workers into opening unsafe attachments or links containing malware. These cybercriminals are waging war against an industry that’s mission is critical to saving human life. They are shutting down emergency rooms, hijacking medical equipment, defrauding patients and clinical staff, and crippling the industry’s ability to care for patients.

A few key highlights from the report include:

• There was a 300% increase in imposter emails sent from Q1 2018- Q1 2019 for targeted healthcare companies.
• 95% of healthcare companies targeted received emails emulating their own trusted domain, and 100% experienced emails emulating their organizational domain targeting patients and business partners.  
• The highest volume of imposter email attacks targeting healthcare came between Monday- Friday from 7 am- 1 pm.
• Subject lines that included “payment,” request,” and “urgent” and related terms appeared in 55% of all imposter email attacks.
• VIPs and other top executives were not always the prime targets. Other highly targeted staff include doctors/physicians, researchers, and administrative staff to healthcare providers, support staff, IT, marketing, and logistics.
• Ransomware incidents steadily declined during the time of the study as cybercriminals switched their focus to banking Trojans malware.
• Banking Trojans were the top threat to healthcare companies, accounting for 41% of malicious payloads during the study period.
• In Q1, 2019, the Emotet banking Trojan, accounted for 60% of all malicious payloads.
• Phishing attacks remained a constant threat and increased considerably in 2019.
• 77% of email attacks used malicious URLs, during the study timeframe.

Cyberattacks today are not only targeting technology; they are targeting people and exploiting the human factor. Healthcare organizations must protect against these threats by using a people-centered approach to security. Cybersecurity experts suggest blocking these threats by using a layered defense, including anti-phishing and anti-malware solutions, filtering controls, and most importantly, employee training. Employees must receive regular training to help them identify threats and take appropriate action when suspicious activity is suspected.

For questions and information regarding employee training contact the experts at MedSafe. MedSafe is the nation's leading one-stop resource for outsourced safety, training, and health compliance solutions in healthcare.

Toll-free: (888) MED-SAFE

www.medsafe.com

References:

https://www.proofpoint.com/us/resources/threat-rep...

https://www.hipaajournal.com/report-reveals-the-mo...