How cyberattacks on healthcare can have dangerous ramifications

A more silent war has been going on for quite a while, under our radar. It is not televised, and images of ruin and human suffering have not yet surfaced, its soldiers and weapons unseen. And yet, it’s very dangerous, affecting more and more people around the world- millions at a time, to be exact.

Cyber warfare has become one of the most dangerous means of war, in accordance with the technological advances of our time. Countries and governments, or hacker groups who act in their name, carry out such attacks cheaply and discreetly. As more and more aspects of our lives become digitalised, the impact cyber-attacks have on us simultaneously increases. Worryingly enough, the healthcare sector is hit hardest, as it can kill. It’s no more about data breaches, it’s about human lives.

2023 has been the worst year ever recorded globally for cyberattacks aimed at healthcare organisations, with no less than 116 million human beings affected in the US only, this being more than double than in 2022, and many more worldwide! Just to name a few; 7 million patients of Delta Dental of California were warned their data was stolen and possibly manipulated in June 2023.

In Seattle’s Fred Hutch cancer centre, some 800,000 people’s data was stolen and access disabled, and a ransom of $50 per patient was demanded for the removal of a single person’s details. In May 2023, 2.5 million patients of Louisville’s Norton Healthcare were also victims of a similar attack.

HCA Healthcare, the US largest for-profit hospital system, reportedly suffered a “theft” of health data affecting as many as 11 million patients. Just last month, Ardent Health Services said it suffered a ransomware attack. The system, which operates 30 hospitals in six states, said hospitals have had to postpone elective surgeries and temporarily divert services.

These attacks aren’t exclusive to the USA; German hospital chain KHO has reported that three of its hospitals were victims to such ransom cyber-attacks, leading to the hospitals’ entire computer systems being shut, with patients having to be transferred to other institutions, as their medical data became inaccessible.

The European Union Agency for Cybersecurity (ENISA) published its first-time report on healthcare cyber-attacks, based on data collected between 2021-2023. It’s conclusions are astounding; the majority of the attacks were targeting healthcare providers and hospitals, 53% and 42% respectively. 46% of the total incidents targeted healthcare data, 83% were financially motivated, and 10% had ideological motivation. 22% of the attacks disrupted the actual delivery of healthcare services to patients.

India is also facing a sharp rise in cyber-attacks. 2022 already saw a rise of 24% in cybercrime; the NCRB states that 64.8% of the cybercrimes were fraud motivated, followed by extortion (5.5%), and sexual exploitation (5.2%). Data for 2023 is as worrisome – an astonishing 10,319 crore was lost to online frauds across the sub-continent between April 2021- December 2023 only, with Delhi leading with the highest per capita cybercrime complaints in India in 2023.

Last year’s G20, which was hosted in India, was also a target for cyber-attacks; Multiple government and law enforcement websites were attacked by different cyber groups. The official G20 website was also a target, and a distributed denial of service (DDoS) was launched against it. Statista released their report in December 2023, and claimed that the IT, Healthcare, Manufacturing and Finance sectors were most likely to be targeted, and that only as low as 24% of all Indian companies were adequately prepared to take on cyber-attacks.

India’s healthcare sector has specifically been hit hard with India’s top institutions such as the All India Institute of Medical Sciences (AIIMS), the Indian Council of Medical Research (ICMR), and corporate drug makers like Sun Pharmaceuticals been attacked. (ICMR) potentially suffered the largest data breach in Indian history, exposing the personally identifiable information (PII) of 81 crore Indians, while AIIMS, suffered a loss of 1.3TB data containing 40 million records back in November 2022. Cybercrime involving large health institutions is becoming more complex and multi-layered.

Ransomware groups are currently infiltrating software and encrypting networks mostly seeking payments from hospitals and other healthcare providers to restore access to networks. Attackers further also simply steal patient records as well. They simultaneously exfiltrate data and hold it for ransom as well, commonly referred to it as the double-layered extortion. This is outright warfare.

We might not intuitively treat it as such, but it may be time that we do so. Millions of people affected, their private data stolen, possibly manipulated and often made inaccessible to their healthcare providers, unless paid for. This directly impacts patients privacy, safety and more importantly medical outcomes. When they attack a hospital, they are sometimes shutting down life critical systems, from diverting ambulances to sabotaging ICU systems and more.

In turn, medical institutions are less trusted by the people, consequently affecting public and private healthcare services of all kinds. Such attacks are also known to have broader psychological impact, considering how unsuccessful governments and institutions have been so far in dealing with such attacks, and preventing them from happening.

Why fight army to army, spend billions of a country’s defence budget, when you can cost-effectively, remotely play with people’s lives, or at least set whole nations on a medical and psychological frenzy?! Just imagine a family member of yours who is allergic to a number of medications. Not having access to his medical records would mean a doctor won’t necessarily know this life-saving information.

If governments, and healthcare providers of all kinds fail to address this new war and implement effective responses, these attacks will become deadlier over time, not just resulting in financial losses and psychological distress, but in many human losses.

Not far are the days in which robotic surgeries will be disrupted, patient monitoring in acute care settings will deliver false data, diagnoses alongside e-prescriptions manipulated and patient data not only publicly exposed but sold and leveraged against innocent people for political or intelligence gains; all resulting in loss of health and life. With global geopolitical instability and a few proxy wars already going on, cyber warfare, might just be our next pandemic. AI may be part of the solution, but is also clearly part of the problem, fueling the capabilities and increase in cyberattacks.

We must address this issue strategically and publicly, and work to create a global coalition to find solutions to this pressing threat, before hacktivists, extremists or other terrorist groups turn medical cyber into one of their most attractive and borderless methods of war. Healthcare service providers of all kinds must prioritise cybersecurity, now.

It’s not just a financial matter; it’s about saving human lives. CNBCTV18