A nasty type of malware known as ransomware has been setting its sights on the healthcare field, with devastating results. Ransomware works by encrypting files on an infected system and demanding payment in exchange for the decryption key. Refusing to pay this demand results in your data being deleted – any paying doesn’t guarantee your data won’t be deleted anyway.
Like most malware, ransomware typically gains access to your network through phishing scams, hiding malicious code in an email attachment or embedded link. It can also be picked up through downloads from compromised websites or infected ads. Once the virus ends up on a system, it can quickly spread across your entire network if steps aren’t taken immediately to contain the infection.
Why target healthcare professionals in particular? There are several reasons for this trend. Hackers and scammers are constantly in search of an easy payout. This kind of cyber attack is a massive inconvenience for any business, but if a medical practice is suddenly without access to patient files and other vital applications, it’s not just an annoyance; it’s a crisis. The wellbeing of your patients riles on your ability to access their medical information quickly, making medical professionals more likely to cave to a ransom demand.
Healthcare information itself is a rich source of income for hackers. It has a high value on the black market, allowing scammers to steal the identities of your patients using the personal information in their files – which can often include financial information – or use patient information to purchase medication or other medical supplies, and resell these items online at a huge markup.
Another major factor is the level of unpreparedness for these types of attacks among healthcare professionals. When it comes to IT security, education and awareness typically begins and ends with privacy and compliancy regulations. If it doesn’t directly affect compliancy, it tends to not be a priority, or even a consideration. These oversights make tactics like phishing scams very effective. It also means your staff is more likely to panic when they realize something is wrong, because they don’t have a clear first step to take to start damage control.
The cost of buying back your data has been steadily increasing, with reports of demands in the $2000 range. But not only does paying this demand not guarantee that you will actually get your data back, in order to keep hackers from coming back an re-encrypting your data, your systems will need to be wiped clean to ensure any traces of malicious code are gone. You’ll still be faced with downtime while your software and applications are reinstalled, and your data is restored from backups.
Protecting your practice from a ransomware attack should be a top IT security priority. With the right precautions, and the right education and training for your staff, you can avoid becoming the next statistic. Start by limiting direct access to servers to system administrators only, and ensuring that each system has functional and up-to-date antivirus and antimalware software installed.
Talk to your IT provider about your practice’s Data Backup and Disaster Recovery Plan. If you do end up facing a worst case scenario, your data backups will be essential. But these backups are only useful to you if they are safe from being infected as well. Keeping your practice protected requires a proactive approach to IT security. If you wait until your practice has already been compromised to start taking care of your IT infrastructure, it might be too little, too late.
Want to learn more about the steps you can take to protect your practice – and your patients – from these threats? Contact us today at sales@onserve.ca or (877) 996-6622. We’re the trusted IT experts for practices in Eastern Ontario.
