Ransomware Attacks Increases in Health Sector

According to a new report published by Sophos, 66% of healthcare organizations were hit by ransomware attacks in 2021. This has risen steeply in comparison to 34% of healthcare organizations which were hit in the previous year.

The silver lining, however, is that healthcare organizations are also getting better with at dealing with the aftermath of ransomware attacks. The report shows that 99% of the organizations that were hit got at least some of their data back after cybercriminals had encrypted during the attacks.

Additional ransomware findings for the health sector include:

Healthcare organizations had the second-highest average ransomware recovery costs with $1.85 million, taking one week on average to recover from an attack
67% of healthcare organizations think cyberattacks are more complex, based on their experience of how cyberattacks changed over the last year; the healthcare sector had the highest percentage
While healthcare organizations pay the ransom most often (61%), they’re paying the lowest average ransoms, $197,000, compared with the global average of $812,000 (across all sectors in the survey)
Of those organizations that paid the ransom, only 2% got all their data back
61% of attacks resulted in encryption, 4% less than the global average (65%)
“Ransomware in the healthcare space is more nuanced than other industries in terms of both protection and recovery,” said John Shier, senior security expert at Sophos. “The data that healthcare organizations harness is extremely sensitive and valuable, which makes it very attractive to attackers. In addition, the need for efficient and widespread access to this type of data – so that healthcare professionals can provide proper care – means that typical two-factor authentication and zero trust defense tactics aren’t always feasible.

“This leaves healthcare organizations particularly vulnerable, and when hit, they may opt to pay a ransom to keep pertinent, often lifesaving, patient data accessible. Due to these unique factors, healthcare organizations need to expand their anti-ransomware defenses by combining security technology with human-led threat hunting to defend against today’s advanced cyberattackers,” he added.

More healthcare organizations (78%) are now opting for cyber insurance, but 93% of healthcare organizations with insurance coverage report finding it more difficult to get policy coverage in the last year. With ransomware being the single largest driver of insurance claims, 51% reported the level of cybersecurity needed to qualify is higher, putting a strain on healthcare organizations with lower budgets and less technical resources available.

The State of Ransomware in Healthcare 2022 survey polled 5,600 IT professionals, including 381 healthcare respondents, in mid-sized organizations (100-5,000 employees) across 31 countries.