Report: Your stolen medical records are as worthy on the dark web as a credit card

Medical data continues to be among the hottest commodities for attackers online as research by security firm Kaspersky discovered that hacking-for-hire groups have added healthcare sector to their portfolio of services on the dark web. The base price for such a service has also become quite cheap, depending on the type of breach or goods an anonymous customer requires.

Thus, with low security measures, and lack of cybersecurity training to hospital staff, hospital and healthcare infiltrations are among the newest services being offered by anonymous hacking groups. These are alongside targeted attacks and cyberespionage against specific countries as well as infections to gain energy and maritime information.

The dark web is made of anything that is not commonly indexed on the surface web. To be able to get into this hidden part of the web, a user should use a special software such as Tor. Tor stands for “the onion router” and is a method for anonymizing data.

Before a check-up or an admission, hospitals generally require a patient’s personal and financial credentials. Thus, security researcher Seongsu Park noted that medical records are likely to be used for calling scam, identity and monetary theft, as well as blackmailing and any derived crimes. He further added, that they can be considered more valuable than a simple credit card.

The current threats posed against the healthcare sector show how more and more malicious actors are targeting the industry. To be able to help protect these organisations and their patients, Kaspersky names the possible security loopholes and how to build their defences below:

• Exposed vulnerable servers and patient records

• The security challenge: These vulnerabilities are usually unintentional and are result of misconfiguration or unconcern.

• The suggested solutions:

• Kaspersky suggests healthcare organisations to identify the important data they are storing and to figure out how they can protect them.

• Increased in education in terms of cybersecurity is also needed so the workforce could know the do’s and don’ts and the signs of a cyberincident. This could be done through a series of Security Awareness Training.

• Complex and ultra-connected medical devices

• The security challenge: The functions of medical devices are becoming diverse and complex. Many medical devices are also being connected to the network without considering its security.

• The suggested solutions:

• An assessment of the hospital or healthcare facilities’ devices and networks should be done to review the access policies and the exposure of the devices to the internet.

• Follow the basic rules including keep all software up to date and institute a strong password policy for devices connected to the web.

• For added layer of security, it is suggested to employ real-time and in-depth threat intelligence as well as holistic cybersecurity solutions into a medical organisation’s IT infrastructure.