NetwworkTigers reviews healthcare cybercrime in 2023 and what this means for customers.
This past year, cybercriminals set their sights on a new target: your health and healthcare data. Healthcare cyberattacks are on the rise worldwide, and the United States has seen some of the most devastating data breaches to hospitals, medical charts, electronic health record software, and more in the past year.
Trends in healthcare cybercrime 2023
According to the Department of Health and Human Services (HHS) Office for Civil Rights, there were a record-breaking 725 significant security breaches in the healthcare industry in the United States in 2023. This is a slight increase from the 2022 data, which showed 720 breaches, making 2023 the most dangerous year on record for healthcare cybersecurity.
Healthcare cybercrime has only risen in recent years. From 2009 to 2010, the industry saw a rapid uptick, from only 18 reported healthcare hacks to 199 reported attacks the following year. Every year since, with the exception of a slight drop off in 2015, the industry has seen exponential increases in the number of successful and attempted hacks reported to law enforcement officials.
In 2023, over 124 million medical records were compromised, with an average of 215,269 healthcare records breached per hacking incident. This means that 93.5% of reported hacked records in 2023 were healthcare-related, and approximately two major healthcare data breaches occurred per day.
More patients affected and more risk to come
What makes healthcare data privacy especially important is its widespread influence in other areas of our lives and the immediate danger it can cause to life and safety. For instance, in 2023, ransomware hackers in New Jersey shut down communication and monitoring systems for two hospitals: Mountainside Medical Center Emergency Room and Hackensack Meridian Pascack Valley Medical Center in Westwood. New patients had to be diverted to other area hospitals, which has the potential to cause delays in life-threatening emergencies.
Healthcare cyberattacks can have these kinds of immediate dangers that may influence them to pay off ransomware gangs, but they also are associated with long-term consequences for patients. Unlike bank account information, phone numbers, or addresses, health information cannot be changed or reassigned. For this reason, medical data is one of the most valuable targets for cybercriminals interested in identity theft. As personal data becomes increasingly digitized through EHR software in hospitals and doctors’ offices, the aggregation of such valuable information makes hospitals and medical offices, chronically under-protected, an even more lucrative target.
For instance, in 2023, the HCA healthcare hack affected as many as one in three Americans. Information stolen included patient names, addresses, dates of birth, and data about patient visits, locations, and dates of medical appointments. As many as 11 million Americans were affected by the data breach from the nation’s largest healthcare chain, even as the company insists that the violation did not disclose clinical information such as diagnoses, prescriptions, and treatments, nor was financial information like credit card numbers. The hack was perpetrated on an outside server used to automate the formatting of email messages, according to HCA, and managed to penetrate the hospital chain’s defenses. Since then, former patients have seen an uptick in phishing attempts through calls, emails, and physical mail referencing “past due” bills from services they never received.
Top 5 biggest healthcare cyberattacks in 2023
In addition to the HCA data breach, other major healthcare hacks in 2023 reveal important trends in cybercriminal activity. Each of the following attacks affected at least 3 million people. Some of the top 5 biggest attacks that occurred in healthcare in 2023 include:
- Perry Johnson & Associates: PJ&A, which offers medical transcription services to doctors to take, collect, and aggregate patient notes, said that it experienced a data breach that affected 4 million New Yorkers’ records. However, no ransom was demanded, and services were not delayed.
- Managed Care of North America: This dental insurance provider was hacked by the ransomware gang LockBit in a breach that allowed cybercriminals the chance to see and copy patients’ private data, including names, Social Security numbers, insurance cards and drivers’ license information, and information about dental appointments. Over 8.8 million Americans were affected.
- MOVEit: The MOVEit data breach was one of the most far-reaching ransomware invasions of 2023, affecting millions of users in the United States and the United Kingdom. Affected companies include the US Department of Energy, British Airways, state pension funds, and various healthcare companies such as Welltok, the Colorado Department of Health, the insurance company CareSource, and many more. The MOVEit hack is especially important as it highlights how an intrusion into a single file transfer software can target many industries at once.
- Cerebral: The telehealth company Cerebral reported an especially upsetting breach of privacy. Mental health self-assessment data, as well as names, dates of birth, email addresses, and phone numbers, were reportedly shared via pixel technology, such as those used by social media giants Meta and TikTok.
- Regal Medical Group: This California healthcare network was breached by a malware attack that revealed patient health information such as diagnoses, prescriptions, treatments, radiology, health plan numbers, names, birthdays, and other identifying information. Approximately 3.3 million patients were affected, and at least 11 lawsuits have been filed in the aftermath of the breach.
Staying safe in the wake of healthcare cybercrime in 2023
The unfortunate truth is that almost all hospitals in the United States have been hacked at least once. Up to 90% of hospitals in the United States disclose that they have suffered a data breach, and many have been hacked multiple times. Ransomware demands are on the rise, and the payouts cybercriminals are asking for now easily number in the multi-million dollar range. The best way to stay safe is to consistently innovate, strengthen, and secure the borders of IT security. Understanding what kinds of hacks are on the rise can help prepare you for tomorrow’s invasion.
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, which built and re-architected data centers for Fortune 500 firms, NetworkTigers provides consulting and network equipment to global governmental agencies, Fortune 2000, and healthcare companies. www.networktigers.com
