Why Hackers Love Healthcare Data

Have you ever wondered how cyber criminals choose their targets?

Vulnerable entities include government websites, medical systems, financial institutions, corporations, small businesses, and individuals.

To figure out the most likely victims, we need to think like hackers.

Cyber criminals ask two main questions when deciding where to strike next:

1. How easy will it be? Criminals run programs to determine the vulnerability level of websites and software, looking for ways to infiltrate and steal information. Better security measures reduce the hacker’s interest.
2. How much is there to gain? Will the company be motivated to pay a high ransom for stolen information? Do they have the resources to do so?

Given these factors, which industry is most attractive to hackers?

The answer may surprise you.

Why Healthcare Data is Vulnerable

Healthcare companies store computerized data on either hard drives or “the cloud.”

Hard drives are internal storage methods on physical units like cell phones, laptops, and desktop computers. To access a hard drive, hackers must either manipulate users into downloading malware onto their device (for example, opening an email to an attacker’s site) or access the device physically (for example, stealing a device or breaking into a building to access a device). This depends on user error, forcing hackers to hope someone opens a phishing email or leaves their door unlocked.

Cloud technologies are external storage methods online that can be accessed by multiple people and companies. To breach “the cloud,” hackers may look for weak passwords or out-of-date cybersecurity protection. Cloud technologies are likely to meet both criteria for an ideal target: higher vulnerability and more valuable information.

Most healthcare facilities use some form of cloud technology to store and access information. As you may have guessed, the emergence of COVID-19 has forced many people to work remotely. Healthcare workers replace staff meetings with emails and phone calls. Physicians consult with patients via teleconference. All of these activities increase a company’s cloud activity, making it more valuable—and more vulnerable—to cyber criminals.

Why Healthcare Data Is Valuable

According to one report, a single Private Health Information (PHI) record is worth up to $250 to a hacker. Compare this to the next highest-value target, credit card numbers, which bring in about $5.40 each.

Why the discrepancy?

Consider the consequences of a stolen credit card number. Upon realizing the breach, the victim will immediately cancel the card. They may file a claim for compensation with their financial institution, and the institution itself will work rapidly to repair the damage. Within hours, the information may become useless to the hacker.

But cyber criminals prefer healthcare records for three reasons:

1. PHI records contain a patient’s complete profile: Social security number, date of birth, payment methods, insurance data, sensitive medical conditions, and doctor/patient communication. Once released, the information can’t be made private again. The hacker might profit for years.
2. Medical system software is often connected with other parties. This could involve pharmacies, insurance companies, hospital networks, affiliated offices, and stakeholders—all accessed with a single data breach.
3. The Health Insurance Portability and Accountability Act (HIPAA), is a federal law to ensure PHI and other personal information is accessed only by approved entities. A HIPAA violation may result in jail time and a fine of up to $1.5 million. The ethical and legal ramifications of a HIPAA breach are severe.

Why would hackers even want this information?

How Hackers Use PHI

Cyber criminals can use PHI in two ways:

1. After a breach, the information may be held for ransom. The affected company is required to pay a large sum of money, after which the hackers promise to destroy their copies of the records. Paying a ransom can avert expensive public relations disasters.
2. PHI may be sold on the black market, especially if a ransom is demanded but not paid. Buyers can illegally get prescriptions and sell pills, receive expensive treatment, or fraudulent medical claims for insurance payouts. They can buy email addresses to spam with malware. They can access bank accounts and credit card numbers.

Clearly, the consequences of a healthcare data breach can be disastrous. That’s why more businesses than ever are taking steps to avoid and mitigate damage.

Protect Your Company

Between January and July 2020, the top 10 healthcare data breaches resulted in the following:

• Nearly 4 million complete or partial records compromised
• Dozens of facilities affected
• Tens of millions of dollars in legal fees, settlements, and ransom payments

These numbers are frightening, but healthcare companies have two ways to make vulnerable data safer:

1. Enhance security measures. Keep software up-to-date, train personnel to use strong passwords and personal security, and encrypt data.
2. Invest in cyber liability insurance.

With hackers constantly revising their methods, it’s impossible to be 100% protected. The good news is that companies can mitigate the effects of an attack with a simple cyber insurance policy.

How to Get Cyber Security Insurance

What should healthcare companies look for in a cyber security insurance company?

• Experience. NOW Insurance has over 20 years of experience providing insurance in the healthcare sector.
• Customized plan options. NOW Insurance won’t trick you into buying something you don’t need. Our unique approach provides just the insurance you need, with quick quotes and online service, and without the extra costs that don’t apply to your business.
• Specialized plans for healthcare practitioners. NOW insurance only works with select industries to ensure the highest quality care.
• Security. NOW Insurance is backed by the world’s leading insurance market, Lloyd’s of London.

The process is simple:

First, determine how vulnerable you are to data breaches with our easy cyber risk assessment tool.

Second, get a no-obligation quote for personalized recommendations. You might be surprised at how affordable it is.

That’s it!

You can’t afford not to protect your healthcare profession. Your reputation, bank account, and patients’ well-being depend on it.