Investigating emerging healthcare cyber threats in 2021

We’ve often discussed how and why the healthcare industry is one of the most vulnerable when it comes to cybersecurity threats. As industry insiders know, this has a lot to do with the fact that healthcare information yields some of the highest prices on the dark web, which is a deciding factor for cybercriminals.

Another potential reason is because cybercriminals now know that healthcare institutions are more likely to agree to their ransoms due to the critical and sensitive nature of medical data.

Despite the sophisticated defensive technology we have today, this trend is on an upward trajectory; a worrying sign for cybersecurity professionals working with healthcare institutions.

In 2020 alone, healthcare was at the receiving end of cyber attacks that exposed 24 million critical healthcare records. According to IBM’s data breach cost report from last year, these breaches costed an average of $7.13 million—a 10% increase from 2019.

Unfortunately, 2021 looks to be just as treacherous for the industry. Here are some of the biggest healthcare cyber threats we can expect to see unfold this year.

Ransomware attacks

Ransomware attacks are by no means a novel threat to healthcare cybersecurity. Today, it is the most damaging threat medical institutions are grappling with across the globe.

According to recent statistics, more than 93% of these organisations were targets of ransomware attacks in 2019, costing them around $25 billion. Wannacry, TrickBot, Bazarloader and Ryuk are a few ransomware programmes that were behind some of the most expensive and most damaging attacks in recent years.

In fact, Ryuk ransomware, which first emerged in 2018, remains to be the most financially damaging attacks we’ve seen. 

A reputable cybersecurity research organisation recently revealed that these cybersecurity incidents were already up by 45% in early January 2021 compared to the end of November. Ryuk was responsible for the majority of these attacks.

Compound attacks

According to Forbes, compound attacks will rise in 2021 as cybercriminals look to increase the leverage they have on the healthcare industry. Compound attacks are a type of ransomware attack in which cybercriminals begin an unauthorised data transfer from healthcare servers to their own. 

The difference between these attacks primarily lies in the fact that the healthcare institution may not realise they are active targets. Hackers only ask for ransoms once the information is under encryption.

WFH attacks

The COVID-19 pandemic forced many healthcare institutions to adopt telehealth and telemedicine technologies to provide uninterrupted healthcare to those in need. While necessary, this increased cybersecurity vulnerabilities for the healthcare industry, as telehealth and telemedicine technology expanded these institutions’ attack surface.

Work from home cyber attacks tend to differ according to each situation as cybercriminals initiate brute force attacks—which have been on the rise since 2020—to infiltrate home networks.

Compounding this issue, these attacks have a causative effect on other threats like email phishing, which is predicted to rise in line with WFH cybersecurity incidents

DDoS attacks

DDoS attacks used to be commonplace in the early 2000s and 2010s but waned in recent years due to the advancements in cybersecurity technology. In the current threat landscape, however, DDoS attacks are becoming popular again.

DDoS attacks are one of the most damaging healthcare cyber threats given that criminals can shut down entire systems which are critical to providing healthcare services. These kinds of attacks are likely to rise in 2021 in response to the industry’s shifting priorities in response to COVID-19 outbreaks and vaccine drives. 

Healthcare cyber threats can cripple the industry—we need to be prepared to face them

While cyber attacks are common, perhaps, even normal, in the interconnected and globalised world we live in, no industry has been hit harder than the healthcare sector, which loses billions of dollars annually as a result of these attacks.

With a sufficient level of awareness of some of these emerging threats, healthcare cybersecurity professionals may find it easier to execute powerful defences to keep cybercriminals out.