Ransomware attacks on U.S. healthcare systems grow in frequency and sophistication

Healthcare delivery organizations are increasingly reliant on health information technology, which boosts their exposure to new cybersecurity risks, such as ransomware attacks. Ransomware is a type of malicious software that prevents users from accessing their electronic systems and demands a ransom to restore access. Ransomware attacks are purposefully designed to disrupt business operations, thereby motivating the attacked organization to make the demanded payment. A new study explores the frequency and characteristics of ransomware attacks on healthcare delivery organizations in the United States. The cohort study used data from the Tracking Healthcare Ransomware Events and Traits (THREAT) database to examine the number and characteristics of ransomware attacks on U.S. healthcare delivery organizations from 2016 to 2021. Healthcare delivery organizations included hospitals, ambulatory surgery centres, clinics, dental practices, mental/behavioural health organizations, post-acute care organizations and others (e.g., emergency medical services clinicians, plastic surgery centres, infusion centres). Read: Ransomware group LockBit apologizes saying 'partner' was behind SickKids attack The main findings of the study are summarized below: From Jan. 2016 to Dec. 2021, 374 ransomware attacks on U.S. healthcare delivery organizations were reported. These ransomware attacks exposed the personal health information of nearly 42 million patients. From 2016 to 2021, the annual number of ransomware attacks more than doubled, from 43 to 91. From 2016 to 2021, personal health information exposure increased more than 11-fold, from approximately 1.3 million in 2016 to more than 16.5 million in 2021. Almost half (44.4%) of ransomware attacks disrupted the delivery of healthcare. Common disruptions to healthcare delivery included electronic system downtime (41.7%), cancellations of scheduled care (10.2%), and ambulance diversion (4.3%). From 2016 to 2021, ransomware attacks on healthcare delivery organizations increasingly affected large organizations with multiple facilities. They were less likely to be restored from data backups and were increasingly associated with delays or cancellations of scheduled care. Across all 374 ransomware attacks, approximately 20% of healthcare organizations were able to restore data from backups. For 59 ransomware attacks (15.8%), some or all of the stolen personal health information was made public, typically by posting it on dark web forums where stolen data are advertised for sale. Clinics (of all specialties) were the most common type of healthcare delivery organization to experience a ransomware attack, followed by hospitals, other delivery organization types, ambulatory surgical centres, mental/behavioural health organizations, dental practices and post-acute care organizations. More than half (52.9%) of all ransomware attacks affected multiple facilities within the attacked organization. Care delivery disruptions occurred during 166 ransomware attacks (44.4%), with 32 attacks (8.6%) associated with a disruption exceeding two weeks. The authors conclude that ransomware attacks on healthcare delivery organizations are increasing in their frequency and sophistication. These cybercrimes disrupt care delivery and jeopardize personal information integrity. Reference 1. Neprash HT, McGlave CC, Cross DA, et al. Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum 2022;3(12):e224873. (accessed January 3, 2022).

Ransomware attacks on U.S. healthcare systems grow in frequency and sophistication

Register for free access or login.

Related Topics