Smaller Hospitals Are Larger Targets for Cyberattacks

Attackers moved from large hospital systems and payers to smaller hospital systems that lack the same level of security preparedness.

By HFT Staff


Even as hospitals and other healthcare facilities have made strides in recent years to improve their cybersecurity defenses, a growing number of attackers have changed the game by targeting a different group of facilities. 

Attackers moved from large hospital systems and payers, big targets that would likely yield the most data but also have more sophisticated defenses, to smaller hospital systems and specialty clinics that lack the same level of security preparedness, staff size or budget, according to a new report

With the healthcare industry continuing to be a top attack vector for cybercriminals and ransomware threat groups, the first six months of 2022 saw an interesting change in targets, according to the report from Critical Insight, a managed detection and response (MDR) service provider specializing in protecting the networks of life-saving organizations and critical infrastructure. The report, H1 2022 Healthcare Data Breach Report, analyzes breach data reported to the U.S. Department of Health and Human Services by healthcare organizations. 

Aside from this change in victim focus, attackers this half of the year hit the jackpot with the Eye Care Leaders electronic medical record (EMR) breach, which exposed more than 2 million records. 

Among the report’s findings: 

  • Total breaches are declining: The number of reported breaches crested during the second half of 2020 when organizations were so distracted by the pandemic that attackers had an easier time breaching their defenses. Since then, the total number of breaches has slowly but steadily declined, from the peak of 393 to 367 in the first half of 2021, 344 in the second half of 2021, and 324 in the first half of this year. 
  • Total individuals affected are declining: The latest numbers are encouraging with roughly 20 million individuals affected in the first half of 2022, representing the third consecutive quarter of declining numbers, a 10 percent drop compared to the prior six-month period and 28 percent less than the first half of 2021. 
  • Most common breach causes: Hacks associated with network servers declined from a peak of 67 percent in the first half of 2021 to 57 percent in the first half of 2022. But EMR-related breaches soared from zero in the first half of 2020 to nearly 8 percent of all breaches in the first half of 2022. 
  • One trend to watch: Looking at which segments of the healthcare ecosystem had hacking/IT Incident type breaches, the firm is seeing smaller hospital systems and specialty clinics rising to the top. Breaches associated with health plans decreased by 53 percent, while attacks against business associates jumped by 10 percent and attacks against providers went up 15 percent. 


September 20, 2022


Topic Area: Information Technology , Safety , Security


Recent Posts

On the Lookout: The Software Supply Chain as a Healthcare Cyberattack Vector

Staying watchful of third-party software vendors and their activities is critical for healthcare cybersecurity.


Hackensack Meridian Health & Wellness Center at Clifton Opens

The Clifton center expands health care access in Passaic County by reducing barriers such as travel and wait times.


Suffolk Breaks Ground on Expansion of White Plains Hospital

The 10-story, approximately 500,000-square-foot expansion is slated to open in 2028.


EVS Leadership Culture Critical in Preventing Hospital-Acquired Sepsis

Cleaning is an essential yet complex component for the prevention of HAI-induced sepsis.


Man Dies by Suicide in Emergency Department Waiting Room at Kansas Hospital

No staff or patients were harmed, and the man was alone in the waiting area when he shot himself.


 
 


FREE Newsletter Signup Form

News & Updates | Webcast Alerts
Building Technologies | & More!

 
 
 


All fields are required. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.