Report: Health care industry faces highest cybersecurity risk

A report by analyst Black Kite found that the health care industry was the most common victim of cybersecurity breaches last year.¹

“Today’s cyber landscape is riskier, costlier, and more complicated than ever before. Bad actors are capitalizing on global disruption with destructive third-party breaches, allowing them to compromise multiple victims in one fell swoop,” Black Kite Chief Security Officer Bob Maley stated in a news release.

A total of 34.9% of cyberattacks occurred in health care in 2022, up 1% from the year before and indicative of hackers’ interest in personal health information (PHI). Heavy regulations on PHI “have only attracted more attention to this sector,” the report said.

“Lack of budget, remotely shared personal data between patients and hospital systems, and outdated software all point to avenues for hackers to infiltrate and gain access to health-related sensitive data,” the report said. “That’s why, again this year, the most affected sector has been health care.”

Health care breaches may be some of the most publicized among various industries because the federal Health Insurance Portability and Accountability Act requires disclosure to the U.S. Department of Health and Human Services’ Office of Civil Rights, and to patients. The federal rule also requires health care entities to complete risk assessments on security systems set in place.

Overall ransomware attacks accounted for 27% of third-party breaches in 2022. That figure was down from 2021 and it appeared that could be an unintended effect of the Russian war in Ukraine, because sanctions have hindered abilities of Russia-based cybercriminals, according to Black Kite.

After health care, finance ranked second for total attacks last year, tallying 14.3%, and government was third, accounting for 9.5% of attacks. Both could see more attacks because banks rely on third party vendors to provide services, while governments often rely on outdated systems with unpatched access points.

Overall, Black Kite reported 63 security breaches among 298 publicly disclosed victims. There were 4.73 affected companies per vendor, compared to 2.46 companies per vendor in 2021. That number measures the number of businesses affected by a single breach of a vendor, not counting the vendor itself.

“Today’s cyber landscape is riskier, costlier, and more complicated than ever before. Bad actors are capitalizing on global disruption with destructive third-party breaches, allowing them to compromise multiple victims in one fell swoop,” Black Kite Chief Security Officer Bob Maley said in a news release. “Cybersecurity leaders must become as agile as the adversary, and that begins with keeping a continuous pulse on your digital ecosystem’s cyber posture.”

Health care organization Highmark Health landed No. 3 on the list of top five cybersecurity breaches of 2022. Black Kite said a security breach exposed information, including names, dates of birth, and prescription information, of 67,147 people.

Automaker Toyota topped the list of top five cybersecurity breaches of 2022. The company “suffered a massive data breach” when an application caused release of data on a software development platform starting in December 2017. Discovering that issue, Toyota changed access codes in September 2022, but 300,000 customer emails were exposed. That followed a February 2022 cyberattack on an interior and exterior parts supplier that disrupted 28 production lines across 14 factories, according to Black Kite.

Reference

1. 2023 Third Party Breach Report. Black Kite. Accessed February 13, 2023. https://blackkite.com/wp-content/uploads/2023/01/third-party-breach-report-2023.pdf