HOSPITALS VS. HACKERS — The health care industry isn’t “battle-hardened” against hackers, cybersecurity experts told Pulse, as the industry reels in the wake of ransomware attacks at two major systems. Cybercriminals took Ascension’s health records offline when they attacked the Catholic nonprofit last week. The strike followed a ransomware attack in February against Change Healthcare, a large medical bills clearinghouse owned by UnitedHealth Group. Cybersecurity attacks in the sector have skyrocketed in recent years, with a 141 percent increase in large breaches reported to the HHS Office for Civil Rights from 2022 to 2023. Ransomware attacks have increased by 264 percent in the past five years, the agency said. Pulse spoke with a cybersecurity expert about the methods cybercriminals use to attack health care companies and why the breaches are so difficult to contain. “Ocean's Eleven” scheme: Toby Gouker, chief security officer of government health at First Health Advisory, which provides cybersecurity consulting to the industry, said hackers spend time in health systems doing reconnaissance before demanding a ransom. “If you’re thinking of the movie ‘Ocean’s Eleven,’ they do that same kind of thing: They study the casino, they learn where the money is kept, where the traffic flows, where the guards are,” he said. By the time they demand ransom, Gouker said, hackers have already locked and encrypted data and stolen backup files that could have been used to restore systems. A new frontier: Hackers have largely steered clear of attacking health systems because they “seemed to have a little bit of ethical behavior,” Gouker said. However, law enforcement action against these groups might have changed that. In February, the Cybersecurity and Infrastructure Security Agency said the administrator of the ransomware service behind the attack on Change Healthcare had encouraged its affiliates to target hospitals after government officials came after the group in December 2023. The agency recently warned about Black Basta, another so-called ransomware service, that it says has targeted health care organizations. Health care systems aren’t ready for the attacks, Gouker said. “Their defenses are a lot more immature than other industries — finance, retail, even oil and gas,” Gouker said. “Those industries are battle-hardened. They’d been attacked 10 to 15 years ago.” What hospitals say: The American Hospital Association disagrees that its members aren’t prepared for attacks and said many of the breaches are due to vulnerabilities in third-party technology. “Hospitals and health systems have invested billions of dollars and taken many steps to protect patients and defend their networks from cyberattacks,” an AHA spokesperson said in a statement. The group has pushed back on HHS’ efforts to mandate cybersecurity standards, citing the costs and urging the government to do more itself. “Cyberattacks are largely perpetrated by sophisticated foreign-based hackers who often work at the permission of and in collusion with hostile nation-states. Defeating these hackers requires the combined expertise and authorities of the federal government,” the spokesperson said. WELCOME TO TUESDAY PULSE. Canadian wildfires could disrupt our summer again. Send your tips, scoops and feedback to ccirruzzo@politico.com and bleonard@politico.com and follow along @ChelseaCirruzzo and @_BenLeonard_.
| 
No comments:
Post a Comment