Since 2020, not a week has gone by without a new cyberattack targeting a hospital or another healthcare organization. In this article, we focus on cyberattacks targeting healthcare institutions and companies, from hospitals to pharmaceutical companies.
The first part will focus on how attackers generate value from these attacks. The second part will provide an overview of the current state of information system security in the healthcare sector in France.
Benefits for Forwards
In France, there was an average of one successful cyberattack per week on a hospital in 2021. The motives vary, but are primarily financial.
Ransomware
Ransomware is a type of malware designed to encrypt data on a computer system, rendering it inaccessible. A ransom is then demanded in exchange for decrypting the data. The data may also be stolen. In this case, it constitutes double extortion because there is also a threat of data disclosure. This type of virus has been considered the new scourge of cyberattacks in recent years. The number of ransomware attacks increased by 255% in France in 2020, according to a study by ANSSI.
The healthcare sector has not been spared. Since February, numerous medical centers have been targeted: Dax General Hospital, Villefranche General Hospital, Tarare General Hospital, Trevoux General Hospital, Oloron-Sainte-Marie General Hospital, Saint-Gaudens General Hospital, the Hopale Foundation (~15 hospitals and vaccination centers), and the FESF Foundation (13 clinics).
Block
Because the data is encrypted, it is no longer accessible to legitimate users, and the IT system is paralyzed. The attacker then demands a ransom in exchange for the decryption key, which is necessary to recover the data and restore normal operations.
However, the availability of the information system in a hospital is essential. In fact, administrative tasks take much longer for staff who do not have access to computers, phones, or email. Patient records, stored digitally on hospital servers, are also inaccessible. Furthermore, certain medical devices require network access or computer monitoring and therefore no longer function, making it impossible to provide care.
These repercussions are all the more serious given that the current challenges are critical: hospitals are overwhelmed by the COVID crisis and the national vaccination program.
Data exfiltration
In addition to encrypting data, the malware can also exfiltrate it to the attacker’s servers. An additional ransom is then demanded in exchange for deleting this stolen information. If the ransom is not paid, the data will be released, either for free or for a fee.
When an organization refuses to pay the ransom, the hackers sometimes turn directly to the affected individuals—such as patients or customers—and ask them to pay it themselves.
Destabilization
The leak of a medical record—or of information contained within it—is very distressing for a person, as such information is, by its very nature, highly confidential. This data can then be used against the victim, for example in smear campaigns.
As for the company responsible for the leak, its brand image could be severely damaged, leading to a loss of trust among customers and shareholders, as well as additional economic repercussions such as a drop in its stock price.
Data Value
Regardless of whether a ransom is demanded, the data itself is highly valuable and can therefore be resold.
Resale of Medical Records
There is a whole industry dedicated to buying and selling data on specialized forums and on the dark web. Transactions there are primarily conducted using the cryptocurrencies Bitcoin, Ether, and Monero, due to their speed, the discretion they offer, and the fact that transactions cannot be reversed or censored. Supply and demand are specific and very consistent.
Health-related data has appeared there relatively recently. According to Kaspersky, “In 2012, when we analyzed the various types of data available on the darknet, medical data didn’t even exist. However, this data is now in high demand because it can be used for a wide range of fraudulent activities.”
It is therefore common to see posts like this one, specifying the type of (medical) data being sought for a specific target (France):
Dozens of other similar announcements regarding health data, from various countries: Russia, China, the U.S., Brazil, …
Purchase and sale prices vary widely, depending on the type of information, the country in question, the date of the database, its size, and so on.
For example, a complete medical record for an American patient sells for between €1 and €25, depending on the victim’s profile. But for 120 MB of French personal data—some of which comes from medical websites—the buyer will only have to pay €2.13.
Sometimes data is also released for free, for various reasons—because it is now too old to be sold, or simply out of spite, as was the case with this database:
This 340 MB dataset contains medical details for approximately 500,000 French citizens, such as: the patient’s last name, first name, and address; their Social Security and health insurance numbers; their billing information (direct billing, direct debit details, etc.); their primary care physician; their blood type; and a very detailed history of their hospitalizations (including details down to the room number they occupied)…
Usage
Targeted Ads and Phishing
By purchasing databases containing personal information, companies in the sector can use them for marketing purposes. This allows them to gain a better understanding of potential customers or to expand their knowledge of existing customers, thereby optimizing communication through personalization. In the case of medical databases, the companies involved may include health insurance providers, insurers, and healthcare centers…
On the other hand, hackers can use this data in similar ways to personalize phishing emails and effectively target potential victims. This involves all the dangers associated with phishing: the spread of viruses, the theft of other data, and so on.
Identity theft
If you have access to certain medical information, such as a patient’s health insurance number or policy number, it is possible to steal their identity.
This identity theft can be used to carry out certain insurance scams, such as claiming reimbursement for fake medical services. But it can also be used to receive free medical care by charging the costs to the victim’s insurance.
Industrial espionage
Data theft in the context of industrial espionage is often orchestrated by rival companies or even governments. Since the healthcare sector is highly competitive, data from medical research commands a high price, especially in the current public health context. Several striking examples of highly targeted attacks occurred in 2020, amid the race to develop a COVID-19 vaccine:
In November 2020, AstraZeneca, the company behind a COVID-19 vaccine, suffered a wave of social engineering attacks. A month later, in December, the European Medicines Agency fell victim to a cyberattack. Documents related to Pfizer and BioNTech were reportedly hacked.
In January 2021, the Pasteur Institute and several research laboratories (INSERM and CNRS) working together on vaccines found themselves the targets of cyberattacks.
These threats are being taken seriously by the various European agencies responsible for cybersecurity, as ANSSI and the BSI have published a joint report warning of the economic and medical consequences of such attacks in the midst of the pandemic.
Author: D.P – Cybersecurity Consultant – Member of the ITrust Red Team
Are you interested in this topic? Check out ITrust’s webinars, co-organized with the Central Purchasing Agency for Hospital IT (CAIH)
> Next meeting: Thursday, June 10, at 11 a.m.!
> Recording of the latest health & cybersecurity webinar:
