Healthcare Industry – The Next Cybercrime Target?

Today, the black market for patient data is up to 20 times more valuable than that for credit card data often stolen in retail breaches. Healthcare data is detailed, rich, and full of information that cybercriminals can use for identity theft and fraud. More importantly, it takes far longer for patients to know their information has been compromised – sometimes up to a year or more.

When a credit card is stolen, algorithms in the financial industry pick up unusual activity very quickly and systems often automatically provide protection. These same protections simply don’t yet exist in healthcare.

Even within the healthcare industry, few people realize just how vulnerable many of the healthcare systems are to cyber attack:

Traditional Cyber Attacks

These are the types of attacks that happen to all institutions. Malware, phishing schemes, trojans, ransomware − they’re all out there, but the healthcare industry is particularly vulnerable because it lacks the built-in protections and underlying security mindset of other industries. These types of malicious software, whether deployed through targeted attacks, compromised websites, spam, infected mobile devices or otherwise, not only expose sensitive data but create distracting and expensive IT headaches. 

These attacks aren’t really new, but their sophistication is and the ability to expose patient data is of real concern. Cybercriminals have developed entire malware platforms that can be customized to attack healthcare organizations. 

Connected Medical Devices

Today, everything from heart monitors to infusion pumps can be networked, automatically interfacing with Electronic Health Record systems and providing real-time alerts to healthcare providers. From the perspectives of patient care and operational efficiency, this is a good thing. From a security perspective, it’s a potential nightmare.

Most of these devices, as well as MRI machines, CT scanners and countless other diagnostic machines were never designed with security in mind. Many diagnostic systems use off-the-shelf operating systems like Microsoft Windows while other devices use purpose-built software designed to collect data − not keep it safe. Too many of these devices are eminently hackable and, once compromised, can provide hackers with unfettered access to the clinical data systems within which they interface.

And it isn’t just patient data that’s vulnerable through connected devices. Cyberterrorists could potentially manipulate machines to intentionally harm patients or shut down critical systems in hospitals. In as early as 2011, one researcher demonstrated how an insulin pump could be hacked to deliver a lethal dose of insulin.

Personal and Home Health Devices

Device proliferation isn’t just occurring in hospitals. An increasing numbers of home health devices, mobile apps, wearables, and more are collecting and transmitting personal health information. Not only do these devices and apps potentially expose patient data (or at least fail to adequately protect it), but they also often interface directly with Electronic Health Records and clinical data systems. When everything from a home glucose monitor to an iPhone app can become part of the attack surface, it becomes clear just how badly exposed healthcare institutions are. As with clinical devices, most of these new patient care modalities are designed for convenience and innovative functionality rather than security.

We should not wait until medical records are breached to address healthcare security. The time to do it is now. The healthcare industry as a whole needs to be proactive, and begin deploying systems with security baked in, protected at both the network and application levels. The stakes are simply too high to wait.


Eric Chan, Solution Consulting Director, Southeast Asia & Hong Kong, Fortinet