2024-08-30 10:15:06
Cyberattacks in Healthcare: The Need for Business Continuity/Recovery
Resilience has become increasingly important to cybersecurity over time. As we become more aware of the inevitability of cyberattacks, we are increasingly working not to prevent them but to limit their impact on the activities of companies and their employees. Resilience includes business recovery and continuity, two key measures to ensure business continuity even in the event of a cyberattack. In healthcare, this often takes the form of a degraded mode procedure (converting from digital to paper information). The cyberattack on London hospitals in June demonstrated the need for such a plan.
context
King’s College Hospital, Guy’s and St Thomas’ Hospital in London are working with Synnovis, a company that provides laboratory services to the NHS.
On June 4, the company suffered a ransomware attack that affected all of its information systems, bringing its operations to a complete halt.
The immediate consequence of the attack was a delay in analytical results. GPs were asked to cancel non-urgent blood test appointments and surgeries were postponed. Management at one of the affected institutions has informed its staff that this situation could develop depending on the duration and scope of the cyberattack.
Several sources in The Independent said that “thousands of patients” were affected. The hospitals attacked cover six areas of the British capital. Due to the attack, patients’ blood types could not be tested as quickly as usual. As a result, the NHS issued an urgent appeal for people to donate type 0 negative and type 0 positive blood.
NHS England London has declared this a regional incident and in order to minimise disruption to these hospitals, pathology centres and emergency centres, the decision has been made to transfer patients requiring long-term care to other hospitals not affected by the attack to ensure continuity of care as much as possible.
Devastating losses
According to NHS London, five scheduled caesarean sections had to be rescheduled, 18 organs were diverted to other services, 736 hospital outpatient appointments and 125 community outpatient appointments had to be rescheduled. Blood tests were also cancelled.
NHS Blood and Transplant is appealing for people with the universal blood type O positive and O negative to donate blood as blood tests are no longer available.
Dark Web: Data Marketplace
That doesn’t even include the possibility that attackers could obtain health data and then resell it on the dark web.
This data may even include the patient’s bank details, giving the data buyer access to their accounts. Healthcare data is sold at a low price: the ZATAZ monitoring service reported in 2022 that on April 17-18, cyber attackers stole data such as patients’ passports, bank information, phone numbers, etc., and then sold them to them for 4 euros per unit.
Ransomware: A pervasive threat that requires business continuity and recovery
As you might have guessed, ransomware encrypts data on workstations, and then, if no protective measures are taken (e.g., vLANs with traffic filtering), it spreads in the local network, potentially affecting and rendering the entire information system of a company unavailable. That’s why business continuity planning (BCP) is becoming increasingly important: it enables businesses to continue operating in the event of IT service unavailability. We also increasingly hear about IT recovery and continuity planning (IRCP), which usually focuses on backups.
Cybersecurity, and especially business continuity, is critical to any company. To protect yourself from increasingly common and devastating cyberattacks, you need to ensure business continuity. Don’t do anything stupid; protect yourself and your business.
Sources:
London hospital hit by cyber attack, affecting 800 planned surgeries (bbc.com)
What is ransomware? | International Business Machines Corporation
PRA and PCA: definitions and differences in terms of activities (napsis.fr)
Business Recovery Plan (PRA): Definition and Phases (obat.fr)
hfds-guide-pca-plan-continuite-activite-_sgdsn.pdf (economie.gouv.fr)
How to create a business recovery plan? Steps + template (appvizer.fr)
1725129126
#business #continuityrecovery #Digital #Economy #Blog
