Healthcare is under attack. Hospitals, doctors’ networks, insurance companies, and others are prime targets for hackers due to the valuable protected health information (PHI) they store and the vital role they play in our nation’s critical infrastructure.
Indeed, 89 percent of healthcare organizations have experienced a data breach in the past two years and the sector was the leading industry for cyberattacks and data breaches in 2018. In 2019, the trend looks to continue with six hospitals and healthcare systems reporting large scale attacks in the month of July alone.
But digital transformation in the healthcare sector is creating a perilous cybersecurity landscape. Cloud-based computing is on the rise and projected to triple in this sector as physicians, administrators, and patients demand secure access to information in a cost-efficient way. Furthermore, medical devices and telemedicine introduce unique IoT security concerns and further expand the cybersecurity threat landscape.
When a cyber attack does occur, the ramifications extend beyond financial and reputational losses. PHI is an extremely valuable commodity for hackers and, unlike other forms of data, is unique to each individual and cannot be replaced. There’s also an emerging and potentially catastrophic human impact. Malware attacks can hijack computer systems and restrict access to critical data, shut down healthcare systems and equipment, and even add tumors into CT and MRI scans.
There are also major regulatory consequences. PHI is leaking to the outside world at an alarming rate. And even with regulations like HIPAA in place, compliance and security are still lacking, as shown by the extensive list of companies on the Department of Health and Human Services’ data breach “wall of shame”.
A deeper dive into the cyber risk facing healthcare organizations
We decided to take a closer look and gauge the security performance of organizations within the healthcare sector. The idea was to better understand where greater risk management is required. Using data collected by Bitsight’s Data Science team as of June 1, 2019, we examined the overall security ratings of healthcare companies, as well as potential vulnerabilities such as legacy systems and software, insecure ports, and instances of already compromised systems.
The results are sobering.
Our data suggests that the organizations in this sector have much to do to improve their security postures. As the chart below shows, only 50% of healthcare companies have Advanced Ratings—meaning they are at a much higher likelihood of breach. Bitsight Security Ratings range from 250 to 900, with a higher rating equating to a better security posture. Anything above 740 is considered “Advanced.” Companies with a security rating of 500 or lower are nearly five times more likely to experience a publicly disclosed data breach.
Breakdown of Security Ratings by Major Industry
51% of healthcare organizations are also dealing with out-of-date systems or unsupported devices, which can be particularly vulnerable to failure or cyberattacks. In the healthcare industry, outdated medical devices are often exploited by bad actors to gain access to the entire network.
The news doesn’t get much better when one considers potential access points such as computers, laptops, mobile devices, tablets, etc. The following metrics show that the ports of 39% of healthcare companies are inherently insecure or vulnerable to cyberattack. That indicates that many of these organizations have several ways for hackers to exploit their systems, such as via medical devices with outdated software or vulnerabilities. Read more about the risks of open port vulnerabilities.
Our findings show that 7% of healthcare companies had one or more botnet infections within the last three months. This number may seem relatively low, but the definition of “botnet” indicates that these infections extend beyond a single machine— whether on their network or not. 
