The Cyber Circus: Health Sector Under Siege
So, layer on the alarms and sound the EU-wide panic button—our beloved health sector, often more vulnerable than a grandma with a new smartphone, is at the mercy of cybercriminals, hacktivists, and even state-sponsored baddies. With the likes of Russia, China, Iran, and North Korea taking notes from The Art of War: Digital Edition, we’ve got ourselves a real titanic tussle on our hands.
The Inconvenient, Fragmented Truth
To set the stage, ANSSI, France’s charismatic cyber super agency, has reminded us that the health sector is a “set of actors characterized by their fragmentation and heterogeneity.” In layman’s terms—it’s like herding cats that have all decided to wear roller skates. The more fragmented the sector, the harder it is to strengthen defenses. And trust me, cybercriminals are loving this chaos more than a baker loves a poorly placed flour bag!
The Sorry State of Security
You’d think hospitals would be Fort Knox with their data, but ANSSI’s report presents a different picture: every ransomware attack is an Olympic event—“since 2020, the healthcare sector has continued to be the target of attacks!” It’s as if ransomware operators have a “two-for-one” special going on, taking advantage of the pressure during COVID-19. Who needs a special occasion to jump on a vulnerability? Not these folks!
Legal reporting requirements and the sensationalism of the media means incidents are more visible than a clown at a funeral. Not to forget, hospitals’ level of security is as “variable” as my chances of finding a matching pair of socks after laundry day! Because, let’s be real, some hospitals are practically leaving the front door wide open and placing a neon sign that says “Welcome Hackers!”
Ransomware: The Uninvited Guest
Between 2022 and 2023, 30 ransomware incidents were reported to ANSSI, representing 10% of all reported ransomware woes. These incidents are like a bad sequel—each time, it’s harder to watch. Attack vectors include illustrious names like Lockbit, Wannacry, and even Blackcat. Sounds like the latest superhero flick, but instead, it’s your local hospital facing cyber-endgame!
And speaking of mortality rates, a study from the University of Minnesota dropped the bombshell that hospital intrusions could increase patient mortality. News flash, folks: if you thought hospital food was the only thing that could kill you, think again!
Cha-Ching: The Costs
ANSSI sets the record straight—remediation of a ransomware attack is costly and time-consuming. The South Francilien hospital center got hit hard, costing them a staggering €7 million! Imagine getting a medical bill and a ransom bill on the same day—talk about an expensive prescription for anxiety!
Oh, and let’s not forget: paying a ransom isn’t the golden ticket to security. Just take Change Healthcare as a prime example. They paid the ransom—only to be hit again by a different group because cybercriminals aren’t known for their loyalty, folks. They’re like the worst ex you can imagine—always popping back up at the most inconvenient moments!
Data Leaks: Sell Your Data? Yes, Please!
And just when you thought it couldn’t get more absurd, data could be resold or exploited. France isn’t off the hook either. Viamedis and Almerys fell victim to data leaks, and guess what? The purpose of the exfiltrated data remains “unknown,” yet it’s presumed likely to be sold for questionable purposes. Who knew personal and medical data could serve as the new black market currency?
Hacktivists and the Digital Circus
But wait—there’s more! Hacktivists are joining the fray! With groups like Anonymous Sudan throwing digital pies in response to real-world tragedies, our hospitals are getting hit from multiple angles. DDoS attacks are the new engagement strategy for these keyboard warriors, proving that everyone has a cause and a script.
Takeaway for the Corporate Clowns
To cap it all off, ANSSI offers a smorgasbord of recommendations—approx. ten pages worth! From basic hygiene like employee awareness (because surprise, surprise, some people still don’t know what phishing is!) to robust security protocols, you’d think they were writing the manual on how NOT to run a circus.
In the end, folks, if you’re in the health sector, it might just be time to throw your arms up in the air, panic a little, and maybe, just maybe, take some of those recommendations seriously before the cyber clowns come back to play! Because while laughter may be the best medicine, cybersecurity is the real lifesaver these days!
In its preamble (pdf), ANSSI emphasizes that the health sector is composed of a multitude of diverse actors, which underscores the inherent fragmentation and complexity within the industry. This fragmentation significantly complicates efforts aimed at bolstering cyber defenses across the entire sector.
These diverse entities find themselves under siege from various malicious actors across multiple fronts: cybercriminals seeking financial gain through data theft or ransomware, hacktivists motivated by political causes and current events, and state-sponsored groups from nations such as Russia, China, Iran, and North Korea, who engage in espionage efforts—particularly focused on sensitive vaccine and treatment information amid the ongoing pandemic.
The level of security is… “variable”
On the matter of ransomware attacks, ANSSI indicates that, “since 2020, the healthcare sector has continued to be the target of attacks ’. During the harrowing period of the Covid-19 pandemic, “many ransomware operators have taken advantage of the pressure on the healthcare sector ”. However, the report clarifies that while the healthcare sector experiences numerous attacks, it is not a specific target for these operators, who predominantly act opportunistically against vulnerable entities across various sectors.
There are ongoing challenges that contribute to the heightened attention the healthcare sector receives: stringent legal reporting requirements mandate disclosure and the “greater media coverage received by structures welcoming the public when they are victims of incidents ”. It is equally important to note that “the variable level of security of entities in the sector, and particularly hospital IT systems, favors their targeting ”.
30 compromises and encryptions in 2022 and 2023
Between 2022 and 2023, ANSSI identified and documented 30 instances of ransomware compromises and encryptions within healthcare establishments, accounting for “10% of incidents linked to ransomware reported to ANSSI over this period ”. The attack vectors utilized are numerous and varied, including but not limited to: Lockbit (including Lockbit 3.0), NoEscape, Bitlocker, Bianlian, Phobos, Blackcat, Blackhunt, Wannacry, Scarab, and ViceSociety.
ANSSI references a recent study published in October 2023 from the University of Minnesota, highlighting a concerning trend in hospitals: “this type of computer intrusion could increase the risk of mortality of patients already admitted at the time of the attack”, a revelation that should not come as a surprise given the stakes involved.
Months of work and millions of euros
The Agency explains that, “Remediation of ransomware attacks and return to nominal operating mode can take up to several months and generate high costs associated with ”. For instance, the cyberattack on the South Francilien hospital center was reported to have cost an astonishing 7 million euros. While some incidents may see faster remediation, “the majority encounter serious difficulties”, cautions the National Information Systems Security Agency.
Paying a ransom doesn’t pay
ANSSI leverages its findings from the health sector to deliver a critical message regarding ransom payments: “paying a ransom in the context of a ransomware attack does not necessarily allow an entity to protect itself against further attacks”. Citing a cautionary example, the agency points to the American health management entity Change Healthcare, which fell victim to a ransomware attack in February 2024. The organization reportedly paid the ransom; however, it soon found itself once again ensnared by another criminal group that claimed access to exfiltrated data, highlighting a recurring cycle of vulnerability.
The report also sheds light on the lucrative side of cybercrime, referencing a hacker named Ansgar who allegedly listed “nearly seven terabytes of personal and medical data of Australian citizens exfiltrated from the systems of Medisecure, an Australian electronic prescription service provider, for the sum of fifty thousand dollars”, illustrating the significant risks involved.
Third party payment: data could be resold or exploited
France has witnessed its share of data leaks, particularly concerning third-party payment providers Viamedis and Almerys during February 2024. The ultimate intentions behind these breaches “remain unknown at the moment. However, the exfiltrated data could likely be resold or exploited for fraud purposes. ”.
Concerning hacktivist attacks, ANSSI recalls that the Assistance Publique-Hôpitaux de Paris was targeted, with the attack being “claimed on the social network Telegram by the hacktivist group Anonymous Sudan in response to the death of Nahel Merzouk”. This year, following the high-profile arrest of Pavel Durov (founder of Telegram), “numerous pro-Russian hacktivist groups, including the Cyber Army of Russia Reborn group, have claimed DDoS attacks against websites of French entities in various sectors ”.
A mess of recommendations
ANSSI concludes its comprehensive assessment by outlining an extensive set of recommendations, spanning nearly ten pages. These insights encompass fundamental yet critical actions, such as raising awareness among employees, mapping out organizational information systems (IS) and their environments, incorporating security requirements in vendor specifications, effectively partitioning systems, managing access rights proficiently, tightening equipment configurations (including BIOS passwords, disk encryption, and deactivating unnecessary services), and developing robust Business Continuity Plans (PCA) and Disaster Recovery Plans (PRA) to mitigate potential crises before they escalate.
What is dark web monitoring
.” The implications of such actions expose the stark realities of the cybercriminal underworld, where personal and medical data has sadly transformed into a commodity on the dark web.
The Ideal Security Playbook? It’s Not a Clown Show!
In light of these alarming developments, ANSSI doesn’t just sit back and watch the digital circus unfold; they actually roll out a comprehensive playbook for healthcare entities. Their recommendations, though extensive and sometimes overflowing with technical jargon, can be boiled down to a few common-sense strategies: ensure robust cybersecurity training for all employees, enforce strict access controls, and conduct regular security audits. It’s almost as if they’re saying, “Hey, folks, maybe it’s time to stop juggling chainsaws and prioritize your cyber hygiene!”
Moreover, they emphasize the importance of collaboration within the sector. In a fragmented arena, sharing information about threats and vulnerabilities can act as a powerful line of defense. By coming together and acting like a cohesive unit instead of a disorganized bunch of solo acts, the healthcare sector can create a more formidable wall against cyber threats.
Final Thoughts: A Call to Action
As amusing as this all may sound, the stark reality remains: the stakes are incredibly high. Cybersecurity is no longer just a tech issue; it’s a critical aspect of patient safety and public health. With the threat landscape continuously evolving, the healthcare sector must undoubtedly step up its game. So, for all the healthcare organizations out there, consider this your wake-up call. Invest in cybersecurity, train your personnel, and stay vigilant because, let’s face it, the cyber clowns aren’t going to stop coming—so you better be ready to outsmart them!
Remember, laughter might be the best medicine, but proactive cybersecurity could very well save lives.
