Healthcare (2/2): Why Is the Healthcare Sector Targeted by Cyberattacks?

Current Status of Information Systems in the Healthcare Sector

Check out the second part of our article on health data! The first part is still available on our blog, examined the value of health data to attackers, as well as the state of cybersecurity in the healthcare sector in France

We discussed this in the previous article: healthcare facilities are a prime target for hackers. Hospitals, for example, are all too often easy prey… With few defenses in place and holding sensitive data, access to their information systems is essential—even vital—to their proper functioning. 

However, some hospitals do not have a Chief Information Security Officer (CISO) or a Chief Information Officer (CIO), and allocate only 1.8% to 2% of their total budget to IT. (Of that, only a tiny fraction goes toward cybersecurity.) Attacking a hospital therefore often takes little time, requires few resources, but can yield significant profits.

Feedback on ITrust audits: 

Our Red Team regularly conducts audits in medical and hospital settings.
Of the last ten audits conducted by our penetration testers in hospitals:

> The overall risk was assessed as major or critical, whether externally or internally.

> On average, it took less than half a day on site to compromise the facility’s entire network (simply by plugging into an Ethernet port or connecting to Wi-Fi, for example, in a waiting room or an empty room).

Main problems encountered:

During our visits, we identified a few recurring patterns that may explain this finding: 

• Significant growth in IT infrastructure (expansion and consolidation of data centers… without network segmentation. As a result, any machine can access any other machine). 
• There are a large number of connected devices to monitor, many of which, moreover, are obsolete. As a result, vulnerabilities known to attackers remain unpatched on these machines. It is important to note that replacing medical equipment is expensive. Furthermore, healthcare facilities are heavily dependent on suppliers, which leaves them with few options for improving the security of their infrastructure.  
• OS obsolescence: Migrating machines can take a long time. (And in the meantime, the IT system is down.) 
• User and machine accounts are shared due to staff rotations between teams (easy-to-guess passwords or passwords written on Post-it notes…). 
• The urgency of the situation, which sometimes leads to safety rules—which slow teams down—being bypassed. 
• The exposure of internal services on the Internet (which makes them vulnerable to external attacks).
• Poorly secured Wi-Fi + accessible Ethernet: This allows an outsider to easily access the facility's internal network. 

Targeting Employees – Presence in Leak Databases:

To refine our estimate of the vulnerability of French hospital services, the ITrust team conducted some research in the Leaks, COMB, and Cit0day databases.

These databases are created from data breaches at companies and/or websites and contain a wealth of information about users (usernames, email addresses, passwords, phone numbers, etc.).

Source : Red Team ITrust

Using this information, attackers can gain direct remote access to the information system (VPN, intranet, etc.) and easily launch, for example, targeted phishing campaigns.

Buying and Selling Information

As cyberattacks in the healthcare sector have become increasingly common, a business has emerged involving the sale and purchase of usernames and passwords belonging to employees in this sector.  As a result, compilations of databases designed to facilitate attacks are now being sold on specialized forums. 

50,000 username/password pairs for French hospital staff

A general trend 

An international study* conducted on 3 million records from 58 different healthcare-related organizations (hospitals, pharmaceutical companies, biotechnology firms) highlights very poor management of access rights: 

• On average, 20% of the documents are accessible to anyone connected to the network
• 50% of organizations have more than 1,000 sensitive documents that are accessible to all employees
• 30% of organizations have more than 500 passwords that never expire
• A total of 31,000 sensitive files that could potentially be accessed by anyone connected to the network. 

Strengthening Cybersecurity in Healthcare Facilities

Against the backdrop of rising cybercrime, with attackers becoming increasingly sophisticated and no longer hesitating to target critical infrastructure, it is urgent for hospitals and healthcare providers to strengthen their security

Defending Against Attackers

If financial and human resources are too limited, turning to a service provider can be a cost-effective solution. 

We also advise our clients to conduct regular audits to identify problems and, above all, to implement the most critical corrective measures. 

In terms of tools, a vulnerability scanner (such as IKare, available as a free trial) is an effective first line of defense against the most common attacks. By scanning the network very regularly, this tool will help identify any new vulnerabilities that need to be patched. 

Ransomware: Don't Pay the Ransom! 

In the event of an attack, we strongly advise against paying the ransom. First, there is no guarantee that your data will be returned to you. It often happens that the decryption key obtained after payment allows you to recover only a portion of the information. Second, there is no guarantee that your data will not be leaked and resold online. Finally, giving in to the cybercriminals’ demands may encourage them to target your organization. 

To learn more about best practices in the event of a ransomware attack, we recommend this excellent guide from ANSSI . 

A Shift in the Government's Perspective 

To end on a positive note, we would like to highlight the government’s announcement last February of a total budget of 350 million euros to strengthen IT security at French healthcare facilities.** ANSSI will also allocate a portion of its funds to support this sector in its efforts to improve security. Training programs are to be implemented, and cybersecurity budgets increased in order to qualify for government grants… This growing awareness gives us hope for progress in protecting our health data and our hospitals!

Author: D.P. – Cybersecurity Consultant – Member of the ITrust Red Team

Are you interested in this topic? Would you like some guidance?

> Discover the cybersecurity tools developed by ITrust 
> Browse our cybersecurity audit catalog 
> Or Join our next webinar Designed for healthcare professionals—come see a demonstration of IKare, our vulnerability scanner!