Content area
Full Text
Healthcare systems around the world have rightly identified the huge potential for digital technology to improve clinical outcomes and transform care delivery. 1 But the recent WannaCry malware attack has once again highlighted cybersecurity as a critical patient safety issue requiring urgent solutions.
Cybercrime-a universal challenge
Cyberattacks usually steal money, data, or intellectual property, but increasingly the aim is to cause overt disruption or political impact. They are often transnational and state sponsored; attributing them to individuals can be difficult. Many attacks are undetected or unreported, and only a small minority enter the public domain; among recent examples are the major breaches at TalkTalk, Mossack Fonseca, the US Democratic National Committee, and Yahoo. The global cost of cybercrime in 2014 was estimated to be $575bn (£440bn; €500bn). 2
Cybercrime and healthcare
Healthcare faces even larger cyber risks than other sectors because of inherent weaknesses in its security posture. It is one of the most targeted sectors globally; 81% of 223 organisations surveyed, and >110 million patients in the US had their data compromised in 2015 alone. 3 4 Only half of these providers think that they are capable of defending themselves from cyberattack, and there has been a 300% increase in attacks in the past three years, 3 5 For those conducting cyberattacks the healthcare sector is an attractive target for two simple reasons: it is a rich source of valuable data, and it is a soft target. The current and emerging cyber risks to healthcare are outlined in box 1.
Box 1: Common and emerging cyber threats in healthcare
Data theftfor financial gain-stealing personal data for the purposes of monetary gain; for example, names, addresses, social security details, financial information
Data theft for impact-theft and public release of sensitive medical information; for example, celebrities, politicians, or other high profile people
Ransomware-using malware to block users from their data or systems or to delete data unless a fee is paid
Data corruption-deliberate corruption of data , such as altering test results, for political or personal gain
Denial of service attacks-disruption of a network or system by flooding it with superfluous requests, motivated by blackmail, revenge, or activism
Business email compromise-creating fake personal communications for financial gain; for...