A computer virus that infected systems throughout the world earlier this year caused millions of dollars in damages to companies in nearly every industry. It also demonstrated that hospitals may be particularly vulnerable to such attacks.
The WannaCry ransomware, which targeted more than 300,000 computer systems in about 150 countries, caught the world’s attention when hospitals in the British National Health Service were infected. But this proved to be just the beginning. The attack spread like, well, a really bad virus, as hospitals in other countries reported intrusions.
In recent months, U.S. hospitals have made headlines as their computer systems have been held hostage by hackers and they have paid “ransom” to release the digital grips.
Hospitals are particularly vulnerable to these types of attacks because they often use old machines and outdated software to perform such vital functions as monitoring patients and dispensing medications. Consider, “health care hardware devices” — such as MRI machines, ventilators and even some microscopes — actually are just computers. They are no different than desktop and laptop computers and mobile devices when it comes to being hacked.
But because of the vital, lifesaving functions they perform and the expanded dependence on sophisticated “machines” that today are even performing surgery, they are often in use 24 hours a day. They often are not being taken offline for updating. And when expensive equipment grows old, it is often they are being used without the support of manufacturers.
Consider the incident Forbes magazine reported recently involving unnamed U.S. hospitals using sophisticated systems to deliver a “contrast agent” to patients undergoing radiology tests. A spokesperson for the system’s manufacturer confirmed it had received two reports from customers in the U.S. with devices compromised by the ransomware.
Hospitals and other businesses are being hit by hackers demanding ransom because it is a relatively easy way for criminals to make a lot of money.
Here’s how most ransomware attacks occur: Hackers infect malware into a computer. This malware, which is called ransomware, then encrypts the computer’s files until “victims” pay to have the files unlocked. The introduction of Bitcoin, a digital currency, has empowered hackers to demand increasingly large ransoms, with hospitals seen as lucrative targets. Because Bitcoin is traded anonymously, the transactions are difficult to track.
Hospitals, like all businesses, also are vulnerable to having customers’ or patients’ confidential information stolen and distributed. And hospital records are rich with the type of detailed patient information that criminals desire. Like other businesses, hospitals also must guard confidential, proprietary company information.
According to the U.S. National Cyber Security Alliance, small businesses account for 81 percent of all cyberattacks and 60 percent of small companies that are victimized shut their doors within six months of a cyberattack because of loss in reputation and customer trust.
Whether it is a hospital or small business trying to protect itself from a cyberattack, these steps should be taken:
- Train staff to recognize risks. While it seems hackers are always one step ahead of their prey, reminding employees not to open suspicious email attachments and to maintain secure passwords is a first line of defense.
- Adhere to a schedule for updating software. That requires taking systems offline to perform updates that often address hacking vulnerabilities.
- Harden systems. Remove equipment from networks when it is appropriate. Separate or compartmentalize systems to prevent one intrusion from infecting many operations.
- Audit systems regularly for vulnerabilities and evidence of intrusion.
- Make cybersecurity a priority. Do not become complacent.
Alphonso Rivera is the founder and CEO of Advanced Micro Resource Digital Forensics, a Bakersfield-based digital forensic company that specializes in digital audits involving cell phone and computer evidence for attorneys, private investigators, human resources consultants and companies.
