Hackers are stealing personal medical data to impersonate your doctor
When it comes to health, prevention is the best cure. Now it’s becoming apparent it is time to extend this philosohphy to medical data as well.
While personally identifiable information — full names, social security numbers, home addresses, dates of birth, credit card numbers — can be exploited by criminals to commit identity fraud, the theft of medical information can have equally serious impact on victims.
Thanks to a new report published by Carbon Black, we now know exactly how hackers use stolen healthcare data to their benefit.
“Valuable data from the healthcare industry exceeds protected health information (PHI) and the hottest offerings today are provider data, forgeries, and hacked health insurance company login information,” the cybersecurity firm noted.
Carbon Black, in particular, notes four different kinds of cyber heists:
- Hacking provider data to steal administrative paperwork — like medical licenses — to forge a doctor’s identity. This data sells on the dark web for around $500.
- Hacking an insurance provider’s login information and then selling it to a buyer, who can then reset the credentials to the database and take a victim’s identity to claim insurance. This can effectively cripple a hospital’s access to patient records and critical systems.
- Forging health insurance cards, prescriptions, and drug labels with an intention to carry drugs through the airport.
- Using hacked personal health information against individuals who have health issues for extortion and other crimes.
The report also included a survey of a number of chief information security officers (CISOs) from the industry. According to the survey results, 83 percent of surveyed healthcare organizations said they’ve seen an increase in cyberattacks in the last 12 months. Nearly half (45 percent) of the companies said they’ve encountered attacks focused on information destruction over the past year.
Importantly, even as companies have stepped up their practices in response, the vast majority of CISOs gave their security posture — an indicator of a company’s overall cybersecurity strength — a grade of C (33 percent). This once again underscores why healthcare providers should do everything in their capacity to secure medical documents.
“With increased adoption of medical and IoT devices, the surface area for healthcare attacks is becoming even larger. The problem has been further compounded by limited cybersecurity staffing and stagnant cybersecurity budgets in the industry,” added the report.
Of course, there’s not much you, as an individual, can do when your doctor or your healthcare provider becomes a victim of such a breach. But given the permanence of medical information and frequency of data thefts, the need for proactive monitoring and effective measures to combat security threats cannot be stressed enough.
What’s more, the proliferation of medical trackers and IoT devices have enabled hospitals to amass medical information on a scale that was previously unimaginable.
The fact that there exists a market for such data should incentivize healthcare institutions to invest more in data backups and auditing their security practices regularly so that critical systems can continue to function. Hopefully companies handling medical data will take notice, and update their policies before it’s too late.
Gloss