How Can Hospitals Prevent Ransomware Attacks?

More than 200 healthcare facilities have fallen victim to ransomware attacks in the last three years

By Mackenna Moralez, Assistant Editor
November 12, 2021

Cybercrimes are on the rise, and no industry is safe – especially healthcare.

Last month, two Indiana hospitals fell victim to ransomware attacks, forcing them to resort to manual methods as their online systems were compromised. These attacks are not uncommon. Hospitals and other healthcare facilities are among favorites for cyber criminals, as more than 200 locations have been targeted in the last three years, and that number is only expected to increase exponentially in the coming years, according to The Wall Street Journal.

“Healthcare facilities are a high valued target in that they offer threat actors the potential of capturing patient information to resell on the dark web,” says Fred Gordy, director of cybersecurity with Intelligent Buildings. “There is also a new threat in the form of ‘Killware.’ According to Gartner, ‘Killware’ is designed to actually harm, or worse, kill humans, In the thousands of assessments, we have performed, we find building control systems to be attached to the web insecurely and easily accessible. These systems control everything from operatory suites, oxygen systems, blood storage, and patient rooms making them an easy target for Killware.”

Sure, there are still scams that are easy to identify, such as, “Click here to receive your $500 gift card,” but many are started to look like they are coming from a manufacturer, service provider or coworker. Because of this, many companies have begun implementing a double-verification system in order to limit the number of malware outbreaks.

“In 2020, there was a 600 percent increase of operational technology ransomware attacks across all business sectors including healthcare,” Gordy says. “Historically, the building system front end has been used as an engineer’s workstation. When a rogue link is clicked, it seizes the front end, and communication to the system is lost. Typically, the system is not being backed up, or if it is, the backups are out of date, making recovery difficult at best. By moving the front-end/application host into either a data center or moving it off the engineer’s desk into a locked closet so that it is no longer used as a workstation, almost 100 percent of the events we have seen could have been avoided.”

Patient information should never be connected to networks that store and transmit information, Gordy says. The International Society of Automation (ISA) standard, Zones and Conduit, should be used on any building control/operational technology network. When hospitals and other healthcare facilities do not use the standard or have a cybersecurity plan in place, the risks can include disruption of service, compromise of the patient network by network traversal, and potentially harm and loss of life.

Mackenna Moralez is the assistant editor of Healthcare Facilities Today.

See the latest posts on our homepage Share

Topic Area: Information Technology

Recent Posts
Recent Posts

How Can FEMA Help Hospitals Mitigate and Recover from Disaster?

Following disasters, FEMA will reimburse 75-100 percent of costs for services such as debris removal, overtime pay, and infrastructure repairs


Advance in Thermal Energy Storage Shows Promise

Breakthrough could play major role in decarbonizing buildings


Alabama Hospital Authority Breaks Ground on New Facility

Hospital set to open in 2024 will include 412,000-square-foot, nine-story hospital with 200 beds


Landscapes Become Focus of Climate Change Strategies

Survey finds growing demand for landscape planning and design solutions to climate change


Ramping Up Foodservice Operations for a Pandemic

Ochsner LSU Health Shreveport overcomes daunting obstacles and challenges to accommodate rapid increases of COVID-19 patients


Post Comment


News & Updates • Webcast Alerts • Building Technologies

All fields are required.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.