A wave of ransomware attacks against hospitals in the United States and United Kingdom late last year shocked the conscious of many cybersecurity professionals. Things have only gotten worse for the health care industry since then.
In the two months following the ransomware hits, digital attacks against health care organizations around the world have spiked further, increasing 45%, according to new research from Check Point. That rise was significantly higher than other industries and coincides with a winter season when many western countries are dealing with overwhelmed hospitals and substantial increases in COVID-19 cases, hospitalizations and deaths.
“This is precisely why criminals are specifically and callously targeting the health care sector: because they believe hospitals are more likely to meet their ransom demands,” Check Point wrote in a Jan. 5 blog.
It’s not just ransomware either; researchers say those figures also include increases in other attacks like DDoS, remote code execution and botnet takeovers. To put the barrage in perspective: in October, the number of weekly attacks in the health care sector averaged 430 per organization. Despite that stunningly-high baseline, that figure was up to 626 per organization for every week in November. Check Point believes that the success of ransomware operators have essentially rang the dinner bell for other cybercriminals and has signaled how easy targets like hospitals and healthcare facilities are to compromise.
Some regions and countries were hit harder than others, but the numbers underscore the global nature of the increase. Central Europe, East Asia and Latin America all saw attacks against their healthcare facilities more than double, with Europe in total (67%) and North America (37%) seeing significant but substantially smaller increases. By country, the biggest jumps happened in Canada (250%), Germany (220%) and Spain (100%).
Unsurprisingly, Ryuk (the same malware that was used to attack UHS hospitals and facilities last October) was the most commonly used ransomware variant found by Check Point. In keeping with other research, most of the ransomware attacks happened on weekends or holidays , when IT or security staff are most likely to take their eyes off the ball.
In an interview in December, Rep. Jim Langevin, D-R.I., told SC Media that he had not noticed an uptick in attention or urgency from fellow policymakers around ransomware following the UHS attacks, though he did add that was in part because many already do take it seriously. Last month, multiple analysts told SC Media that despite media attention the attacks against UHS received, they did not expect ransomware actors to be cowed or deterred, and many expected the upward trajectory to continue apace.
“I haven’t seen any evidence of attackers avoiding targets because they attract too much heat. I’ve actually seen the opposite trend,” said Israel Barak, chief information security officer for Cybereason. “I’ve seen hackers moving toward the type of targets that by cripplying and taking away their operational capability, would create a maximum impact on their business and maximum leverage for them to pay the ransom.”
In fact, Barak said that many ransomware operators may feel more emboldened after the attacks. Since they largely operate outside the reach of law enforcement, many ransomware operators “enjoy that publicity and enjoy that aura of ‘I’m behind this’ [because] it makes them look bigger and more significant in their community.”
