2018 Promises to Be Lucrative for Hackers in Healthcare Industry

It’s nearing the end of another data breach packed year for the healthcare industry, with over 27 million records breached in 2016, 2017. This area is not about to be left on the sidelines. It too is on track to be a lucrative year for hackers who just can’t keep their greedy paws off that personal healthcare data.

Listed are a few of the notable ones for many reasons, not just the sheer number of victims, which ranges from 18,000 into the millions. Various types of breaches are listed, including ransomware attacks, phishing, physical loss, carelessness, and extortion.

2

Everyone knows about WannaCry, which started with the National Health System in the UK. It was set loose via a phishing email and spread to 150 countries within two days. But it wasn’t alone.

The Arkansas Oral Facial Surgery Center was hit in July by a ransomware attack that held 128,000 patient records hostage. The month prior, Pacific Alliance Medical Center also had 266,000 records held for ransom and Airway Oxygen, a home medical equipment supplier was a victim of ransomware. Employees were locked out of information on half a million customers.

A breach of Peachtree Neurological Clinic data was discovered in 2017, but there is suspicion the hackers were in the system in February of 2016. It was ransomware that did them in.

It’s likely most of these were due to phishing attacks. However, some are known to be as a result of someone falling for it. At UC Davis Health, an employee responded to an email and provided a hacker with login credentials. That allowed him or her to view patient data as well as use that person’s email account to send other messages to fellow employees and request large sums of money.

2

Molina Healthcare data was breached when a security flaw left data on 4.8 million exposed. The flaw left data accessible without any type of authentication. All it took to find patient data was to change one character in the URL.

Vulnerabilities in the MongoDB servers were well-publicized this year. Various hackers took advantage and hijacked over 26,000 of those servers. Because of this flaw in MongoDB, these attacks were shockingly simple to pull off. The hackers just scanned the Internet for the open data and took it.

2

Two notables fit into this category for 2017. In April, it was discovered that a hacker known as Skyscraper had breached various organizations and accessed data on half a million children. About 200,000 of the records were from elementary schools, highlighting how it’s important to know what schools are doing with data we provide them on our children.

In May, the infamous hacker TheDarkOverlord hacked three organizations and accessing records of 180,000 patients. The plan was to extort money from the organizations or expose the data to the world by posting it to the Internet. And that is exactly what happened. The three organizations were New York City’s Aesthetic Dentistry, OC Gastrocare in California, and Tampa Bay Surgery in Florida.

The same hacker hit again in June when he leaked over 12,000 records from two California healthcare organizations.

2

Anthem BlueCross BlueShield made the news again this year when an employee of third party Medicare coordinator, LaunchPoint Ventures stole data of 18,000 members. It’s believed the information was to be used for healthcare fraud.

In another incident, an employee of the global health insurance provider, Bupa copied names, customer information, nationalities, and more of more than 108,000 customers. Investigators believe the information was provided to outside parties to be used for fraud.

In April, a locked safe at Washington State University was opened and a hard drive containing survey responses from 1 million participants was discovered missing. It included healthcare information on those participants.

2

The most careless and dare we say irresponsible one was due to a lazy software developer. He was contracted by HealthNow Networks, which is a telemarketer. The couch potato was supposed to create a database of customer information. Instead, he uploaded a backup of data of 918,000 seniors to a server and left it exposed on the Internet. He never actually finished the project, which ended in 2015, stating it was just “too hard.” However, the data remained exposed until 2017. It has since been removed. Unfortunately, it’s unlikely the affected victims will ever be contacted about this.

Bronx-Lebanon Hospital Center was also in this category. In May, it was discovered that potentially millions of patient records were exposed when someone at a third party vendor misconfigured a backup process.

And an unknown number of Medicare and Childrens’ Health Insurance Program (CHIP) patients in Indiana were victims when their data was left unsecured and viewable by anyone when a link to a report was left accessible. It’s not known precisely or even roughly how many victims were in this one, but as of April of this year, there were 1.1 million patients enrolled in the program.

All of these demonstrate various risks in the healthcare industry. The data is valuable on the Dark Web. Each record can sell for up to $300 and it’s often used for healthcare fraud. Ensuring that all data is secured and doing thorough research on third party vendors is becoming more important than ever. Don’t forget that locking up hardware and holding those accountable for not following cybersecurity procedures is a critical part of any organization’s cybersecurity process. While it’s easy to get lax, it’s important not to.