Cybercrime Trends
Threats increasing in 2022
At the start of the pandemic Cyber-crime increased by a factor of 15 with a huge increase in Coronavirus and NHS-themed scams.
Practices continue to use online tools such as websites, social media accounts, payment systems and email newsletters. These all provide opportunities for hackers to exploit any weaknesses for huge financial gain, so the risk of attack will only continue to increase and get more devious.
Healthcare has been a key target for cyber-criminals, with 67% of healthcare organisations experiencing a cyber security incident in 2019.1
Global cloud provider, CISCO have seen a continuation of the trend for more complex, multi-stage attacks that involve multiple threat types. Their 2021 report has highlighted that overall, cryptomining, phishing, ransomware, and Trojans are the most active threats, averaging 10x the internet activity of all other threat types.
Get your cyber insurance cover quote now
Phishing
Phishing is an old tactic, but it continues to be used because it is simple and effective. With hackers masquerading as a trustworthy entity, it accounts for 90% of data breaches by targeting the weakest link in the security chain: the user.
You could become a victim of Business Email Compromise (BEC) attacks that originate within the supply chain. These are notoriously hard to detect because hackers use compromised corporate email accounts from known and trusted individuals to trick the recipient into believing they’re speaking with a legitimate contact. They look very convincing and often slip under the radar of traditional secure email gateways (SEGs) and anti-phishing filters.
The pandemic has increased this activity as malicious actors exploit people’s vulnerabilities and current concerns. They create fake sites that mimic genuine health government bodies, for those seeking information around free testing sites, vaccine sign up sites etc.
Ransomware
Data collected by The University of Cambridge, shows that ransomware cyber insurance claims have grown at an alarming rate over the past five years, with the protagonists getting more and more sophisticated in their approach. At the end of 2020 there was a particularly aggressive ransomware threat called Ryuk, which has caused particular problems for the healthcare sector. It is a type of crypto-ransomware that uses encryption to block access to a system, device, or file until a high ransom is paid in untraceable bitcoin. It has been able to get around many anti-malware countermeasures, completely disabling computer networks, including several UK Hospitals.
Trojans
In 2020, the healthcare industry saw more trojans (malicious programs disguised as legitimate software) than any other sector2, as well as higher numbers of droppers. A dropper is a program or malware component designed to “install” some sort of malware (ransomware, backdoor, etc.) into your system.
The second biggest activity in the healthcare sector was phishing with these two together made up three quarters of malicious traffic they encountered.
Healthcare sector still a prime target- especially under stress
The personal and financial information contained in medical records means healthcare workers process and share incredibly sensitive personal data. That makes it highly valuable on the black market.
Beazley’s 2019 Breach Briefing listed healthcare as the most targeted industry, with accidental disclosure the top cause of loss.3
Employees, contractors, and those with privileged access to user accounts can all be responsible for insider threats.
Working long hours in high-pressure environments makes healthcare workers more prone to phishing attacks and mistakes.
Data security provider Clearswift published a report last year4 that revealed that almost half (48%) of incidents within the healthcare sector occurred as a result of introduction of viruses or malware from third-party devices, such as IoT devices or USB sticks, and employees sharing information with unauthorised recipients (39%).
In addition 37% of users were not following their protocol and data protection policies and 28% had received malicious links in emails and on social media.
What can you do to protect yourself?
Controls need to be diligently deployed and patching of vulnerabilities needs to be maintained in a timely way. Now is the time to re-enforce your cyber security efforts to reduce the risk of everything from unwanted data loss to malicious attacks.
Training staff around the need for strict protocols in cyber security should be ongoing, your employees are your first line of defense. Plus, you need to ensure the implementation IT security best practice.
Information on threat levels can be monitored with updates published at the Centre For Internet Security.
Find out about Cyber Insurance
42% of businesses do not know about or have no intention of buying cyber insurance. Healthcare practices present a higher risk to insurers than other businesses because of the medical data that is collected, stored and processed. As we represent thousands of medical practices in the UK, we’ve been able to partner with a panel of insurers to make life easier for you.
Will your practice survive a cyber-attack?
How would your practice staff react to a cyber attack? Are you confident they would know what to do?
Read more
How has Covid-19 impacted cyber security?
UKs National Cyber Security Centre (NCSC) latest annual review revealed that 28 % of incidents they handled in 2020 were related to coronavirus
Read more- https://www.pharmatimes.com/news/cyber_attacks_hit_more_than_half_of_healthcare_orgs_in_last_year_1322396
- https://learn-umbrella.cisco.com/ebooks/2021-cyber-security-threat-trends-phishing-crypto-top-the-list
- Beazley Breach Briefing 2019
- https://www.clearswift.com/resources/press-releases/healthcare-cybersecurity-research-2020
