Criminals know how lucrative healthcare cyberattacks can be. As reported by Forbes, an electronic health record (EHR) could be worth hundreds, even thousands, of dollars on the black market. And unlike a credit card or financial record, a medical record is a living document that can be used by criminals over a person’s lifetime — there’s no closing down a health record. For example, a threat actor could use sensitive information about health conditions and diseases to extort a victim for years.

“From a purely monetary perspective, medical records, depending upon their completeness, can fetch upwards of $1,000 per record,” according to RedLock’s Matt Chiodi. “Contrast that number with credit cards, where the typical value is $30.”

Unfortunately, with its value fully realized, medical information is now more susceptible to theft due to the pervasiveness of electronic records. Over the last decade, healthcare clinics and hospitals have widely adopted EHR systems to save on costs. However, while they’re more efficient than paper systems, digital records are also vulnerable to cyberattacks.

Healthcare Cyberattacks Beyond the Doctor’s Office

Hospitals and medical clinics aren’t the only healthcare entities that need to keep their data secure and private. DNA and genomics-analysis services also store sensitive biodata in the interest of serving their clients. Are the threats that these types of companies face the same as a traditional healthcare provider? What kinds of attacks do they need to guard against? And what are they already doing to shore up defenses and protect customer data?

“The general fear is actually with the customer signing away their DNA profile to a testing company,” said Chris Jordan, CEO of the security firm Fluency. “There has been little concern of the theft for malicious intent, mainly due to the mapping to value of the data. The real threat is that the value is unknown, meaning that two years down the road people might start seeing a value to the data, and your DNA data may be on a system with inadequate protection.”

Is Your Company at Risk of a Different Kind of Infection?

Cybercriminals exploit healthcare organizations for a variety of purposes, including data manipulation through loss, leakage and spoofing. One of the most common threats targeting the sector is ransomware, as evidenced by the massive WannaCry attack that infected hundreds of thousands of endpoints on healthcare networks in more than 150 countries around the world in May 2017.

As Bloomberg reported, attacks of all kinds against healthcare organizations have increased in the last year and show no signs of slowing — particularly when it comes to phishing and ransomware attacks used to gain access to private data.

According to Rami Muleys, head of application security business development at Positive Technologies, the threat of ransomware is evolving to become even more targeted.

“Moving forward, there’s a chance that cybercriminals could change tactics and, instead of destroying sensitive data, use it for targeted attacks,” he explained. “As an example, a patient with a sexually transmitted disease could find themselves blackmailed; a patient with an allergy could be attacked with his or her allergen.”

Critical Condition: How to Keep Healthcare Data Private

What are businesses that collect biodata doing to protect sensitive data and client information?

A spokesperson for personal genomics and biotechnology company 23andMe noted that customer data is stored in “walled-off segregated computing environments” and protected by a “comprehensive security program that utilizes de-identification — which protects an individual’s identity by removing all registration information, name, email address, etc. to protect the unique set of information associated with our service.”

The spokesperson also noted that each customer can choose whether to participate in research or share his or her data, and that the company does not share personal information without explicit consent.

Beyond policies, basic security practices are more important than ever for today’s healthcare workforce.

“Healthcare organizations should perform regular security assessments of their systems,” Muleys advised. “Not just the usual HIPAA compliance assessments, but beyond formal requirements, including practical penetration tests.”

The stakes are just as high for heathcare-related businesses that gather and store data about clients’ health and genetic backgrounds. Companies that work in this space will see an increased level of scrutiny as more data breaches inevitably hit the sector in the coming months and years. Security managers at these enterprises need to keep their data privacy and security strategies front and center in business planning.

Listen to the podcast

More from Data Protection

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…

The Importance of Modern-Day Data Security Platforms

Data is the backbone of businesses and companies everywhere. Data can range from intellectual property to critical business plans to personal health information or even money itself. At the end of the day, businesses are looking to grow revenue, innovate, and operationalize but to do that, they must ensure that they leverage their data first because of how important and valuable it is to their organization. No matter the industry, the need to protect sensitive and personal data should be…

Meeting Today’s Complex Data Privacy Challenges

Pop quiz: Who is responsible for compliance and data privacy in an organization? Is it a) the security department, b) the IT department, c) the legal department, d) the compliance group or e) all of the above? If you answered "all of the above," you are well-versed in the complex world of compliance and data privacy! While compliance is a complex topic, the patchwork of regulations imposed by countries, regions, states and industries further compounds it. This complexity has turned…