As healthcare becomes increasingly digitized, the potential for cyberattacks also grows proportionally. Electronic Medical Records (EMR) Software systems store vast amounts of patient health information, from patient medical records to medical billing and insurance information. Furthermore, the confidentiality of such information is crucial for HIPPA compliance and other such regulations.
Thus, the consequences of a cyber-attack, on any healthcare organization, can be devastating. Not only could it impact finances, but also patient trust, safety, and confidentiality.
Over the past decade, there have been several cyber-attacks that have shaken the healthcare industry and have revealed critical vulnerabilities in its digital infrastructure. We’ll be diving into the 3 Biggest Hacks in Healthcare It Systems: what went wrong and what can we learn from them?
The 3 Biggest Hacks in Healthcare IT
1. WannaCry’s Disruption of the NHS
The Attack
In May 2017, the WannaCry ransomware spread like wildfire across the globe. It affected organizations from governments, banks, universities, to companies like Taiwan Semiconductor Manufacturing Company (TSMC), Nissan, FedEx and more relevantly: the National Health Service (NHS) England & NHS Scotland.
For those unfamiliar with the term ransomware, it’s a type of software virus that encrypts all files on the targeted system – thus making them inaccessible. Typically, the attacker will demand a large ransom in exchange for the encryption key. Basically, an attacker will lock your files and say: “pay us and you can get your files back”.
This flavor of malware targeted computers running Microsoft’s Windows OS. By making use of a Windows vulnerability called EternalBlue. Though Microsoft had released security patches, outdated systems were still left exposed and defenseless. The NHS was particularly vulnerable due to its use of an outdated Windows OS and poor patch management practices.
Fortunately, a security researcher (Marcus Hutchins) discovered a “kill switch” within the ransomwares code that prevented the virus from spreading any further.
Fun Fact: The Eternal Blue vulnerability was originally discovered by the U.S National Security Agency (NSA) and subsequently leaked by a hacker group called “The Shadow Brokers” in 2017 (only a month before it was used by WannaCry!)
The Effects
In total, over 200,000 computers across 150 countries were infected, but the NHS bore some of the most severe operational consequences. It’s reported that 70,000 devices (including computers, MRI scanners, blood storage refrigerators and theatre equipment) may have been affected.
Additionally, since clinicians could not access patient medical records, many ambulances had to be turned away from affected hospitals. Thousands of emergency operations and routine appointments had to be cancelled due to WannaCry.
2. The DeepPandas Hack on Anthem, Inc.
The Attack
In 2015, the second-largest health insurance company in the United States – then known as Anthem, Inc. (now Elavance Health) – fell victim to a sophisticated cyberattack that compromised the personal information of nearly 80 million people. The attack was one of the largest breaches of healthcare data in history.
The breach began with a phishing campaign. An Anthem employee unwittingly opened a malicious email attachment, which triggered the deployment of a backdoor into the company’s network. From there, attackers moved laterally through the system, eventually gaining access to 50 employee accounts and over 90 systems.
The Effects
With these privileges, they exfiltrated sensitive records containing names, birthdates, Social Security numbers, medical IDs, and employment data.
The culprit was a group known as DeepPandas (often associated with the Chinese state-sponsored group APT 19 – though this connection remains ambiguous).
The breach exposed just how quickly and silently attackers can move once inside a poorly defended network, and how attractive healthcare data is for cybercriminals.
3. The Department of Veterans Affairs Data Leak
The Attack
The U.S. Department of Veterans Affairs (VA) has experienced several cybersecurity incidents, but one of the most significant occurred in 2006, when a VA employee’s unsecured laptop containing unencrypted data on 26.5 million veterans was stolen.
The Effects
Unfortunately, the stolen data included names, dates of birth, Social Security numbers, and some medical records; enough information to facilitate identity theft on a massive scale. Although the laptop was eventually recovered with no evidence of data misuse, the event triggered a Congressional investigation and prompted a major reevaluation of the VA’s cybersecurity policies.
Though not a malicious hack in the traditional sense, the incident underscored a security issue far more common than one might expect: insider risk and poor data handling. It remains a defining example of how poor cyber hygiene – not just complex attacks – can result in widespread exposure.
Lessons Learned & Strategies to Prevent Attacks
Cybersecurity in health IT cannot just be reactive, but it needs to be proactive. From these stories we can take away a few key lessons:
- Cyber Hygiene Matters!
- Cyber hygiene involves setting up strong passwords and enforcing strong password policies (including complexity rules and periodic password changes).
- Furthermore, Multi-Factor Authentication (MFA) adds an extra layer of protection beyond passwords, and though often overlooked can be the key to preventing many attacks.
- Another consideration is the use of Passkeys, which offer even greater protection than typical passwords and are now being adopted more widely.
- Patch Management is Critical
- WannaCry thrived because organizations failed to apply known patches. Regular system updates and vulnerability scans are crucial to closing exploitable gaps.
- Best practices include a dedicated team for managing software and organizational security. They would be responsible for handling and enforcing security policies, managing software (and by extension software updates/patches), and more.
- Data Encryption and Secure Storage
- The VA breach could have been avoided if data had been encrypted. Encrypting data when stored and during transmission is a basic security practice – especially when devices leave the office.
- Encryption ensures that even if an unwanted party got their hands on sensitive data, it would be unusable. Though there are edge cases where encryption algorithms can be broken, encryption is a simple way of limiting damage from most data breaches.
- Imagine if the VA had simply encrypted their data!
- Improve Security Culture and Awareness
- Something that cannot be stressed enough is awareness. People are often the weakest link in security. Ongoing training, clear policies, and a culture that values cybersecurity can drastically reduce risk.
- You’d be surprised by how easy it could be for someone to click on a suspicious link or attachment (remember DeepPandas?) According to Cisco’s 2021 Cyber Security Threat Report, phishing makes up for around 90% of all data breaches (and that statistic could increase with the advent of AI phishing!)
- Incident Response Planning
- Even the best defenses can fail. Health organizations need a robust incident response plan to detect breaches early, contain damage, and recover quickly.
Conclusion
The healthcare industry is uniquely vulnerable to cyberattacks due to the value of health data and the life-critical nature of its services. The DeepPandas hack on Anthem, the WannaCry ransomware crisis at the NHS, and the Veterans Affairs data breach each reveal different facets of the threat landscape – from phishing and ransomware to poor data handling.
As health IT continues to evolve, so too must our cybersecurity strategies. It’s not just about protecting data after all – it’s about protecting lives.
