Ransomware, a type of malware that holds a computer hostage and tries to force the victim to pay money to recover access, is a nightmare for any business, but the healthcare industry faces the more severe side of a ransomware attack. The healthcare industry receives a whopping 15 percent of all ransomware attacks across all industries. It’s therefore essential to look at why the healthcare industry is such a prime target so businesses can adjust their IT security strategies to keep both information and patients safe.
Why is the Healthcare Industry a Prime Target for Ransomware?
While the malware family tree is fairly expansive, the ransomware branch alone is responsible for 72 percent of all malware attacks in hospitals for 2016. Even though industry experts say victims should never pay the ransom, one study found as many as half of victims have done exactly that. Unfortunately, this pattern persists because it works. The healthcare industry, with an emphasis on hospitals, exhibit three behavioral patterns that make them prime targets:
- Hospitals have a reputation for running on older operating systems with known vulnerabilities hackers can exploit. Hospitals may need to use outdated operating systems to work with vital, legacy software. Alternatively, it could also be an IT oversight. Even Macs are vulnerable to ransomware.
- Healthcare operations may need access to specific computers and files immediately or they risk losing a patient’s life, so this makes them a prime target to pay the ransom. When faced with paying a $500 unlock fee or risk a patient dying, there’s not enough time to look at other options.
- Hackers assume healthcare operations are financially well off and can afford to pay the ransom.
Phishing with Spears, Not Nets
Since healthcare operations are such a prime target, hackers are going as far as creating ransomware-infection mechanisms that emulate specific software. For example, the ransomware infection mechanism may create a window that’s designed to look like a common patient information window. However, instead of closing the window or saving changes, the window forces the computer to download malware. These attacks are often aimed at specific employees with top-level-access.
What the Healthcare Industry Can Do
- Backups Are A Lifeline: The more often your business runs data backups, the less information it stands to lose. Frequent backups allow your business to access versions of files just a few hours to days old, which minimizes the damage ransomware can inflict.
- Emphasize Keeping Software Up-To-Date: Ransomware rarely reinvents the wheel and instead relies on exploiting known security holes that vendors have already patched up. Making sure every program on every computer in your business updates to the latest version as soon as possible will offer exceptional ransomware protection.
- Use the Cloud: Ransomware has a very difficult time seizing data from applications run through the cloud. Therefore, switching to a cloud platform offers additional security.
While the healthcare industry is a prime target for malware, all businesses need to be concerned about the many types of ransomware in the wild. If you would like to learn more about how your healthcare business or other type of company can protect itself from ransomware, contact the experts at MPA today!
You might also want to read: The “Seven Deadly Sins” of Ransomware.