Attacks on healthcare organizations grew by 94% in 2021, according to Sophos

Sophos, a global provider of next-generation cybersecurity, has released “The State of Ransomware in Healthcare 2022,” a new sectoral survey report. The findings show that ransomware attacks on organizations in this sector have increased by 94%. In 2021, 66% of healthcare organizations were affected, up from 34% the previous year.

According to the survey data, the silver lining is that healthcare organizations are becoming better at dealing with the aftermath of ransomware attacks. The report shows that 99% of healthcare organizations affected by ransomware recovered at least some of their data after cybercriminals encrypted it during the attacks.

Additional ransomware findings for the healthcare sector include:

• Healthcare organizations had the second-highest average ransomware recovery costs with $1.85 million, taking one week on average to recover from an attack
• 67% of healthcare organizations think cyberattacks are more complex, based on their experience of how cyberattacks changed over the last year; the healthcare sector had the highest percentage
• While healthcare organizations pay the ransom most often (61%), they’re paying the lowest average ransoms, $197,000, compared with the global average of $812,000 (across all sectors in the survey)
• Of those organizations that paid the ransom, only 2% got all their data back
• 61% of attacks resulted in encryption, 4% less than the global average (65%)

“Ransomware in the healthcare space is more nuanced than other industries in terms of both protection and recovery,” said John Shier, senior security expert at Sophos. “The data that healthcare organizations harness is extremely sensitive and valuable, which makes it very attractive to attackers. In addition, the need for efficient and widespread access to this type of data – so that healthcare professionals can provide proper care – means that typical two-factor authentication and zero trust defense tactics aren’t always feasible. This leaves healthcare organizations particularly vulnerable, and when hit, they may opt to pay a ransom to keep pertinent, often lifesaving, patient data accessible. Due to these unique factors, healthcare organizations need to expand their anti-ransomware defenses by combining security technology with human-led threat hunting to defend against today’s advanced cyberattackers.”

More healthcare organizations (78%) are now opting for cyber insurance, but 93% of healthcare organizations with insurance coverage report that getting policy coverage has become more difficult in the last year. With ransomware being the single most common cause of insurance claims, 51% of respondents reported that the level of cybersecurity required to qualify is higher, putting a strain on healthcare organizations with limited budgets and technical resources.

In the light of the survey findings, Sophos experts recommend the following best practices for all organizations across all sectors:

• Install and maintain high-quality defenses across all points in the organization’s environment. Review security controls regularly and make sure they continue to meet the organization’s needs
• Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines and open Remote Desktop Protocol ports. Extended Detection and Response (XDR) solutions are ideal for helping to close these gaps
• Make backups, and practice restoring from them so that the organization can get back up and running as soon as possible, with minimum disruption
• Proactively hunt for threats to identify and stop adversaries before they can execute their attack – if the team lacks the time or skills to do this in house, outsource to a Managed Detection and Response (MDR) specialist
• Prepare for the worst. Know what to do if a cyber incident occurs and keep the plan updated

The State of Ransomware in Healthcare 2022 survey polled 5,600 IT professionals in mid-sized organizations (100-5,000 employees) across 31 countries, including 381 healthcare respondents, and is available on Sophos.com.