Rise in cyberattacks on healthcare organisations 

Urgent work is needed to help healthcare organisations develop a common language and cybersecurity planning.

The number of cyberattacks on healthcare organisations has significantly increased over the past five years, and it is no longer a case of asking if it will happen to an institution, but when it will happen.

That was the message presented to Irish health workers at the Smart Health Summit 2021 yesterday.

Speaking at the virtual conference, Dr Saira Ghafur, digital health lead, Institute of Global Health Innovation and Security Science Fellow Institute for Security, Science & Technology at Imperial College London said healthcare is “one of the only industries globally, for which the biggest threat to data breaches comes from internal sources.” 

Citing a report by the Ponemon Institute in the US, Dr Ghafur said nearly half (46%) of all cybersecurity breaches were due to employee behaviour, most of which came down to clicking on an “affected link” in an email.

It is critical that healthcare organisations prepare themselves as much as possible for future incidents, she said, and given the risk that human error presents to data breaches and cyberattacks in healthcare, the need for cybersecurity training is vital.

However, "limited budgets and lengthy approval processes are attenuating health services' ability to adapt" to cybersecurity challenges.

There has been “chronic underinvestment in health IT”, especially when compared with other critical sectors which usually spend  4% to 10% of their annual budget in this area compared to 1% to 2% in the healthcare sector, she said.

Urgent work is needed to help healthcare organisations to develop “a common language and scalable cybersecurity planning.” 

Cybercriminals clearly exploited widespread fear and confusion caused by the pandemic in 2021, Dr Ghafur said, with a number of healthcare systems globally targeted in cyberattacks, including the ransomware cyberattack that hit the HSE in May.

“What we've seen, especially over the past 18 months throughout Covid, is that cyberattacks are becoming more and more egregious, they’ve evolved from amateur hacking to state-sponsored sophisticated activity”, she said, adding that hackers and attackers recognise the significant disruption that can be caused by targeting the healthcare sector.

In December 2020, the HSE announced more than 120,000 of its employees would receive cybersecurity training from technology company Cisco.

Topics covered in the training were to include data privacy and how to prevent hackers taking control of a system to earn a ransom payment.