Hospitals and the healthcare industry are being deliberately targeted by hackers seeking "treasure troves" of personal and financial information, a business consulting firm has warned.
Attacks by organized gangs or even state intelligence agencies are a growing concern as they seek details that can be used for blackmail or even espionage.
The theft of personal information from a Singapore health database of 1.5 million people, including the prime minister, by a state-run spyhighlighted the threat.
Hospitals and clinics are more vulnerable to attacks than banks or government institutions, despite representing a “mine of valuable information,” said Gregory Garrett, head of international government security. He went on to point out: “Hospitals and the healthcare industry hold electronic records of everyone involved. They hold personal data and in most cases, credit card information as well.”
The UK's National Cyber Security Centre said it was working closely with the health and social care sector to ensure platforms are as "safe and resilient" as possible.
The damage that can be caused was highlighted in the WannaCry that destroyed NHS computers, as they were hit alongside other businesses around the world.
The Department of Health later reported that the attack had cost the NHS $92 million, with a third of hospital trusts having computers locked down in a bid to hold them accountable for ransom. The attack caused 200,000 computers to lock users out, with red-letter error messages demanding payments in Bitcoin. The ransomware attack was carried out by North Korean hackers.
However, attacks specifically target healthcare to steal information. In the first half of 2018, US healthcare organizations reported 176 major data breaches. While criminals seeking to steal or encrypt and then cash in on sensitive data are the biggest threat, the countries behind these attacks are also looking for useful information.
“They are targeting hostile states for the theft of intellectual property related to medical research, innovation, cancer and population health studies, precision medicine research and clinical trials, and conversion for military use,” said John Riggi, a former FBI agent and cybersecurity expert.
Sensitive medical details of business innovators, politicians or military personnel could also be useful to spies.
When hackers breached a Singaporean government health database, they obtained names, addresses and – in some cases – details of the medicines dispensed. Details of Prime Minister Lee Hsien Loong, including his medication, were repeatedly targeted by criminals.
A cybersecurity firm in March 2019 attributed the attack to a well-organized “state espionage group” called Whitefly. Symantec said Whitefly had been operating since at least 2017 and had also hit targets in other areas of the country to steal large amounts of personal data. The company did not say who sponsored Whitefly.
“There is a real concern from the military cybersecurity community and the intelligence community around the world about targeted attacks on healthcare industries,” Mr. Garrett said.
Targeting hospitals near military installations could leak sensitive records of military personnel.
“If you could infiltrate one of these hospitals and learn that a large number of troops were there recently for a particular vaccination, that could give you insight into where the troops might be used in the near future.”
The medical records of businessmen or their families could be useful in industrial and criminal espionage.
However, healthcare institutions often work with legacy computer systems and in particular in the past may not have focused on security, even though it has always been an “information rich environment”.
