One of the more recent developments in the world of malware has been an approach known as “ransomware.” This type of attack has a social engineering component, preying particularly on those who aren’t particularly tech savvy. While your average IT professional recognizes ransomware when they see it, the vast majority of people do not.
Ransomware uses malware programs that covertly install themselves on a user’s computer, often via trojans disguised as a legitimate program. This executes encryption of the user’s files, making them inaccessible. Then, a message is displayed that demands a payment in exchange for decrypting the files. Decrypting the files is impossible without the key, rendering the user helpless to retrieve their data.
One of the more troubling aspects of ransomware attacks is that in many cases, they work. It’s not uncommon for users and organizations to make the decision to simply pay the scammers, rather than lose critical files.
How Ransomware Targets Hospitals
Recently, hospitals have been increasingly at risk of falling prey to ransomware attacks. In fact, in Q2 of 2016, a threat report from Solutionary Security found that 88% of ransomware attacks targeted hospitals. There’s a reason behind this: confidential patient data can be worth big money in the black market. Hospitals have a lot to lose in an attack of this nature, making it highly important that these facilities take measures to protect themselves and their data.
The effects of a ransomware attack can be disastrous. In February 2016, Becker’s was told from an anonymous source that Hollywood Presbyterian Medical Center in California had their systems shut down by a ransomware attack demanding a steep $3.5 million dollar payment. This wrought havoc on their electronic systems. Physicians found themselves completely shut out of their EHR, and staff were unable to communicate via email. Many outpatients missed treatments due to the attack, or had to physically pick up test results, prescriptions, and other materials that might otherwise be relayed electronically.
The incident at Hollywood Presbyterian was a stark reminder of the growing threat of ransomware targeted at hospitals. It’s essential that hospital IT teams take significant measures to defend against this type of attack.
How Hospital IT Can Stay Protected Against Ransomware Attacks
There are several potentially effective measures that hospital IT resources can use to decrease the chances of such an attack, and to minimize the impact if an attack occurs. One of the biggest reasons that ransomware is often successful is that hospital data & databases are not backed up sufficiently. Many attacks could be avoided by implementing a robust backup system. Verified backups located both offsite and offline are protected from attacks– cloud or server-based backups may still be accessible to hackers.
Educating non-technical staff is also essential. It’s important for physicians, nurses, and other supporting staff to be aware of the dangers of downloading and executing unknown or suspicious files, as well as knowing the indicators of spam and scams. Many of the world’s most brilliant physicians aren’t particularly proficient with computers, so it’s important for IT personnel to provide necessary education about malware threats.
With educated staff and robust backup protocols for all important data, hospitals can put protections in place to prevent themselves from falling prey to ransomware attacks. In medicine, lives are at stake, and malware attacks can impact the quality and availability of patient care. For this reason, it’s essential that hospitals remain aware of the threat from ransomware, and sufficiently protected against it.
To consult your data protection experts, contact Cornerstone! We provide healthcare IT consulting services and Oracle database consulting services in Atlanta, Chicago, and Texas!
