Healthcare IT

Cybercrime is increasing in the healthcare sector

Intel security warns that the market for stolen healthcare data and the business of cybercrime is growing in the healthcare sector. However, it adds that the value of stolen healthcare data has not yet eclipsed that of stolen financial data. Middle East Health reports.

Intel security has recently released a report which warns the healthcare industry to be aware of and take appropriate precautions against the growing threat of cybercrime.

The warning is made clear in their recently released McAfee Labs report – ‘Health Warning – Cyberattacks are targeting the health care industry’. The report assesses the marketplace for stolen medical records; compares it with the marketplace for stolen financial services data; identifies healthcare focused cybercrimeas- a-service trends; and profiles cybercrime targeting intellectual property in the pharmaceutical and biotechnology industries.

“In an industry in which the personal is paramount, the loss of trust could be catastrophic to its progress and prospects for success,” said Raj Samani, Intel Security’s CTO for Europe, the Middle East, and Africa. “Given the growing threat to the industry, breach costs ought to be evaluated in the Second Economy terms of time, money, and trust – where lost trust can inflict as much damage upon individuals and organizations as lost funds.”

The value of stolen data
Intel Security found that the price per record for stolen patient medical records remains lower than financial account records and retail payment account information, despite the increasingly timesensitive, or perishable, nature of data such as credit and debit card numbers.

In recent years, Intel Security has observed the cybercriminal community extend its data theft efforts beyond financial account data to medical records. Although credit and debit card numbers can be cancelled and replaced quickly, this is not the case for protected health information (PHI) that does not change. This “nonperishable” PHI could include family names, mothers’ maiden names, social security or pension numbers, payment card and insurance data, and patient address histories. But, though this dynamic has led to industry speculation that the price per medical record could soon rise to rival or even eclipse that of financial account or payment card data, Intel Security’s 2016 research did not illustrate such price-point movement.

The research found the average health record price point to be greater than that of basic personally identifiable information, but still less than that of personal financial account data. The per record value of financial account data ranged from US$14.00 to $25.00 per record, credit and debit cards drew around $4.00 to $5.00, but medical account data earned only from $0.03 to $2.42.

The findings suggest financial account data continues to be easier to monetize than personal medical data, which could require an investment that financial payment data does not require. Upon stealing a cache of medical records, it is likely cybercriminals must analyze the data, and perhaps cross-reference it with data from other sources before lucrative fraud, theft, extortion, or blackmail opportunities can be identified. Financial data, therefore, still presents a faster, more attractive return-on-investment (ROI) opportunity for cybercriminals.

“Liquidity trumps longevity in the race to monetize stolen data,” said Samani. “If I steal a million credit or debit card numbers, I can quickly sell this digital merchandise before banks and retailers discover the theft and cancel these numbers. Alternatively, a million medical records contain a rich cache of permanent PHI and personal histories, but such data requires a greater investment of time and resources to exploit and monetize it.”

Theft of Intellectual Property
Intel Security’s research also investigated the targeting of biotechnology and pharmaceutical firms for their intellectual property and business confidential information. The researchers suggest that the economic value of such information is considerably higher than the cents-perrecord data Intel Security’s researchers identified within patients’ health care accounts.

Intel Security researchers found evidence that formulas for next-generation drugs, drug trial results, and other business confidential information constitutes significant value. The stores of such data at biopharmaceutical companies, their partners, and even government regulators who are involved in bringing new drugs to market have become a premium target of cybercriminals.

“Corporate espionage has gone digital along with so many other things in our world,” Samani said. “When you consider that research and development is a tremendous expense for these industries, it should be no surprise that cybercriminals are attracted to the ROI of this category of healthcare data theft.”

The research also identified cybercriminals leveraging the cybercrime-as-a-service market to execute their attacks on healthcare organizations. Researchers found evidence of the purchase and rental of exploits and exploit kits to enable the system compromises behind healthcare data breaches. In one case, a relatively non-technically proficient cyber thief purchased tools to exploit a vulnerable organization, leveraged free technical support to orchestrate his attack, and then extracted more than 1,000 medical records that the service provider said could net him about $15,000.

The researchers also observed brazen efforts by cybercriminals, through online ads and social media, to recruit into their ranks healthcare industry insiders with access to valuable information.

“When a well-developed community of cybercriminals targets a less prepared industry such as health care, organizations within that industry tend to play catchup to protect against yesterday’s threats, and not those of today or tomorrow,” Samani said. “Gaining the upper hand in cybersecurity requires a rejection of conventional paradigms in favour of radical new thinking. Where healthcare organizations have relied on old playbooks, they must be newly unpredictable. Where they have hoarded information, industry players must become more collaborative. Where they have undervalued cyber defence overall, they must prioritize it. In the Second Economy, if you win the ‘time’ contest with attackers, you are in a position to preserve money and trust.”

The report concludes: “One troublesome issue with this topic is the lack of evidence pointing to the motivation behind the acquisition of stolen medical data. With payment card information, we have documented that stolen card numbers are used to conduct fraud against the victims. In the course of our investigations we have identified where specific data is sought to verify the addresses of the victims. At present, however, we have not identified specific uses for bulk data purchases of medical data. We will continue our research on this topic because it deserves significant attention, and will post updates as we find more data.”

Health Warning – Cyberattacks are targeting the health care industry


Date of upload: 17th Jan 2017

                                               Copyright © 2016 All Rights Reserved.