Beat Ransomware: Privacy Protection as Corporate Strategy

The following is a guest article by Ron Zayas, Founder and CEO at Ironwall360, an Incogni company

Stemming access to private employee info can close cracks in the network

The recent data breach that took down UnitedHealth, a company that processes 15 billion healthcare transactions annually through Change Healthcare, was an ominous portent of the vulnerability that healthcare organizations face from the threat of ransomware.

While the exposure of patient records in the attack was concerning enough, how the breach comprehensively affected practitioners, pharmacies, insurance companies, and patient care was just as significant. One diabetic patient faced the choice of paying $1,200 out of pocket or going without medical supplies that could risk life-threatening complications. Prescriptions and insurance claims were delayed; medical forms had to be filled out by hand instead of electronically; providers could not confirm whether patient care bills were paid. Weeks after the initial breach, hundreds of hospitals remained offline.

But while this attack generated national headlines and congressional scrutiny, it was not unique. The healthcare industry is among the most frequently targeted by hackers—other victims from this year alone include North Carolina’s Columbus Regional Healthcare System, Singing River Health System in Mississippi, New Jersey’s Mountainside Medical Center, the Wichita Urology Group, Texas’ Ardent Health Services, and technology company HealthEC.

The reason is obvious: when a data breach can put lives at risk, the provider’s motivation to pay the ransom is stronger. That’s what Change Healthcare did, to the tune of $22 million. And yet, the ransom itself is only a fraction of the company’s financial hit, which could grow to $1.6 billion. Change has also provided over $6 billion in advance funding to support its other healthcare providers impacted by the breach.

There is currently no greater security challenge to healthcare IT systems than ransomware. The US Department of Health and Human Services has instituted standards for hospital cybersecurity and levies significant fines for non-compliance. But while billions of instances of malicious traffic are blocked every year, many still succeed. As one network security expert commented, “We’re outgunned.”

The impact on patients

What happens when patient records are exposed? In addition to using an individual’s personally identifiable information for identity theft, phishing scams, and other tactics to steal, hackers may also employ extortion to further enrich themselves.

Providers such as Seattle-based Fred Hutchinson Cancer Center and Oklahoma City-based Integris Health have reported that their patients have received emails attempting to blackmail them – a tactic hackers hope will apply additional pressure on providers to pay the ransom. Breaches at plastic surgery centers have resulted in intimate images being publicly posted. One group demanded $50 per patient to delete their data.

The most that healthcare organizations can do in response is to offer standard identity theft protection. If someone then tries to leverage exposed content to access bank accounts, the attempt will either be stopped, or a record of the breach will restore any lost funds.

This is helpful, but nowhere near fully restorative. When someone catches the flu, they’re happy for medication that alleviates their symptoms, but they would most certainly prefer any action that could have helped them avoid getting sick in the first place.

Ideally, this kind of proactive strategy should also be the focus of healthcare organizations. To keep would-be scammers and thieves away from personnel files and patient records, forward-thinking companies are taking steps to protect themselves before their systems are compromised.

Where to start? By figuring out where you are most vulnerable. That process should include safeguarding servers, detecting unpatched software, and securing IT systems against brute-force credential attacks. But while these were the hackers’ best access points years ago, they have now found an easier path to deliver a ransomware payload – a phishing email with a malicious link.

Our employees won’t fall for that.

Don’t be too sure. While the clumsy, old-school phishing attacks still fool thousands every year, scammers know that most people now see through the Nigerian prince swindle and other obvious bait. What’s different today is the entrance of artificial intelligence, now being used to revolutionize the phishing threat landscape. The key ingredient is the personally identifiable information of potential victims to exploit. And it’s always available – because we’ve already given it to them.

For example, here is what an old phishing scam looks like:

Your trained personnel will likely be able to recognize this security threat and quickly trash the email. But what if this arrived instead?

*Click on image to see a larger view of the email example above

It’s easy to see why emails like this got through in about 5% of penetration tests. The photo, the use of a nickname, the citing of details that only a close associate would know…how could a hacker in Russia possibly know all that about you? So one of your employees – maybe the receptionist hired just last month or maybe one of your top executives – clicks on the link in the email. Their device is now compromised, which means your network is compromised.

Where did cyber criminals find out so much about your personnel? Probably from one of the more than 5,000 data brokers worldwide, all of whom are building profiles on all of us, all the time, with content they are able to acquire easily. Think about how many times you’ve filled out a form that asked for your cell phone number, home address, or email address. Think about how many companies have that information, from your bank to the pizza place down the street. That content gets sold or exchanged against lists from other entities. The information itself is the commodity, and no regard is given to where that information may end up or how it may be used.

Take control of the privacy of your employees

Hackers may be smart, but they are also lazy. In searching for their next victim, if they find a trove of available content at one organization and much less from another, they will opt for the target providing the most fuel to their efforts. The ideal target offers data that helps hackers customize their phishing emails through AI, ultimately improving their odds of success.

The objective is to be an organization where there is less accessible personally identifiable information related to those who work there.

A corporate account that monitors and eliminates personal information online can cost just a few dollars per employee per year. These services not only lower the volume of available content; they can replace authentic information such as home addresses and cell phone numbers with alternatives that cannot be traced back to their user.

Education is also consistently important. While every healthcare organization almost certainly provides helpful training on recognizing the common signatures of phishing emails and texts, a refresher may be necessary. Employees need to be briefed on the capabilities of AI-generated emails and how vigilance now is more important than ever.

Perhaps most critically, the industry as a whole must stop treating ransomware as an IT issue. This is a corporate challenge, and the conversation should be elevated to the C-suite with an eye toward asset protection and risk management.

It may be an uncomfortable thought, but we must all realize that ransomware gangs have weaponized our home addresses, cell phone numbers, email addresses, and other private content that is publicly accessible. To lower the risk of this information being used in a successful phishing attack, it’s essential to raise awareness with employees as well as vendors. Healthcare organizations must explore both preventative and reactive measures as a new standard in strategic, data-compliant business operations.

About Ron Zayas  

Ron Zayas is an online privacy expert, speaker, author, and CEO of Ironwall by Incogni. Ironwall provides online privacy protection to both the public and private sector. For more insight into online privacy laws, proactive strategies, and best online data practices, visit ironwall360.com. Connect with Ron at [email protected].