A goldmine of vulnerable patient data and intellectual property

Every industry has its own unique concerns, threats and challenges related to cybersecurity. Healthcare organizations, which deal with patient data and other highly sensitive information, are unfortunately particularly attractive targets to bad actors.

It's important to note that the healthcare industry encompasses a broad group of organizations, including healthcare delivery organizations, insurers and life sciences companies. While each of these segments manages massive amounts of data, the most prominent threats and most effective countermeasures will vary depending on the type of data stored.

For this article, we are focusing specifically on healthcare delivery organizations (i.e., hospitals, health systems and medical groups) that handle extremely high volumes of patient data, including personal health information (PHI), driver's licenses, insurance cards, social security numbers and more, which are highly valuable targets for any hacker looking for financial gain. Once hackers get ahold of this data, patients are vulnerable to financial damages including identity theft, fraudulent credit card charges and accounts, and loans.

One of the less intuitive — and most harmful — forms of data theft can happen in pediatric healthcare delivery organizations. Hackers can steal the data of minors for financial exploitation, which may not be discovered for years until those individuals reach adulthood and go through the credit check process.

Healthcare industry data is also vulnerable to secondary and tertiary extortion. For example, a hospital may be attacked with ransomware and compelled to pay a fee to regain access to critical IT data and services. Months later, the same attackers could demand another ransom with the threat of releasing the data on the dark web. They could also contact individuals whose data was stolen to further exploit them for financial gain.