Summary:
In 2024, 84% of healthcare organizations (HCOs) experienced cyber-attacks or intrusions, with account hijacking and phishing being the most prevalent threats, according to a Netwrix study. The survey, conducted among IT and security professionals worldwide, found that certain threats are more common in specific IT environments. For instance, 74% of HCOs using cloud-based systems faced user account compromises, compared to 44% in on-premises environments. Phishing incidents affected both cloud (62%) and on-premises (63%) environments nearly equally.

Security Officer Comments:
Healthcare continues to be a prime target for cyber-attacks, particularly ransomware, with 21% of ransomware attacks in the past year directed at healthcare organizations, up from 18% the previous year. Dirk Schrader, VP of security research at Netwrix, emphasized that healthcare workers frequently communicate with unfamiliar individuals (patients, laboratory assistants, external auditors, etc.), making it difficult to thoroughly vet each message. Additionally, the priority placed on patient care often sidelines essential security awareness training, increasing the risk of security incidents. The healthcare sector is also more vulnerable to financial and reputational damage from cyber-attacks. According to the study, 69% of healthcare organizations reported that cyber-attacks negatively impacted their financials, compared to 60% in other sectors. Moreover, 21% faced leadership changes, and 19% dealt with lawsuits, higher than the 13% reported in other industries. Consequently, data and network security were identified as top IT priorities for healthcare organizations (64% and 54%, respectively), surpassing automation (46%).

Suggested Corrections:
Healthcare providers should employ strong passwords and implement multi-factor authentication to secure user accounts, alongside regular security awareness training to help staff recognize phishing attempts. Additionally, organizations should employ advanced threat detection tools to identify suspicious activity early and ensure regular data backups are in place. Regular software updates, strong endpoint security, and segmenting networks can further reduce the impact of potential ransomware attacks.

Link(s):
https://www.infosecurity-magazine.com/news/account-compromise-phishing/