Healthcare data breaches: A persistent threat despite cost reductions

The healthcare sector continues to be a prime target for cybercriminals, despite some encouraging developments in breach-related costs. In 2024, the average cost of a data breach decreased to $9.77 million from $10.93 million in 2023{{Footnote.N76502}}.

However, this reduction shouldn't lead to complacency – healthcare remains the most targeted industry for cyberattacks, with potentially devastating consequences for both patients and providers.

Healthcare data security vulnerabilities

Healthcare facilities, whether doctors’ offices, clinics, hospitals or imaging and diagnostic testing and research facilities, face a unique set of data security challenges due to several factors:

• The complex flow of sensitive medical data between various devices and systems, such as CT scanners, ultrasound machines and administrative computers, creates multiple potential points of data loss vulnerability.
• Many organisations lack sufficient cybersecurity specialists and coherent security strategies, often making ad hoc decisions about equipment and software purchases when budget surpluses arise – rather than following a comprehensive security plan. This is especially true of smaller practices but still aggravated by the global shortage of cybersecurity professionals.

These vulnerabilities, combined with the critical nature of healthcare operations, make it essential for organisations to move beyond reactive security measures and develop comprehensive, proactive protection strategies. The consequences of failing to address these challenges can be far reaching and severe.

The extensive impact of data breaches

When healthcare organisations experience data breaches, the consequences extend far beyond immediate financial losses:

• Patient trust erodes quickly when medical records are compromised, potentially leading to serious health consequences if treatment information is altered or made inaccessible.
• Providers often face significant reputational damage, resulting in decreased patient enrolment and financial instability.
• Operational disruptions can be extensive, requiring substantial resources to restore systems and data, while simultaneously managing increased costs and lost revenue.

Such is the scale of this problem, a 2024 Sophos survey{{Footnote.N76503}} revealed that 37% of healthcare organisations required more than a month to recover from ransomware attacks, with nearly all victims reporting attempts to compromise their backup systems.

The growing ransomware challenge

Ransomware has continued to be one of the most significant threats to healthcare facilities worldwide. In 2023, these attacks accounted for 54% of cybersecurity incidents in the European Union. More concerning is that only 27%{{Footnote.N76504}} of surveyed medical facilities had implemented specific ransomware protection programmes.

Healthcare organisations are particularly attractive targets due to their critical operational nature and the sensitivity of their data. When patient care systems are compromised, medical facilities face immense pressure to restore services quickly, often making them more likely to pay ransoms than organisations in other sectors.

The stakes are exceptionally high. Delays in treatment or access to medical records can directly impact patient outcomes.

Modern ransomware attacks have evolved beyond simple data encryption to include data theft and double-extortion strategies, where attackers threaten to publish sensitive patient information unless additional payments are made.

This puts healthcare providers in the difficult position of weighing patient privacy concerns against service continuity.

Despite the severity of these threats, implementation of ransomware-specific defences remains inadequate across the sector. Many facilities lack proper network segmentation, robust backup protocols or comprehensive incident response plans tailored to ransomware scenarios.

Navigating global cybersecurity regulations and compliance

Governments worldwide have recognised the need for stronger data protection in healthcare. As a result, they are implementing increasing levels of regulation – to help emphasise the serious nature of threats to the sector.

At a base level, the European Union enforces the General Data Protection Regulation (GDPR) for overall data protection, while the NIS2 directive addresses network and information security across specific vertical sectors – including healthcare.

In the United States, the Health Insurance Portability and Accountability Act (HIPAA) continues to evolve, with recent updates strengthening cybersecurity protections for Electronic Protected Health Information (ePHI).

The European Commission has also proposed an Action Plan on Cybersecurity in Healthcare to enhance the sector's resilience against attacks, recognising that regulations alone are insufficient without proper education and support.

Meeting these regulatory requirements demands robust technical solutions, with encryption playing a particularly significant role in protecting sensitive data. However, not all encryption solutions provide equal levels of security and compliance.

Why hardware encryption is essential for protecting healthcare data

When it comes to protecting healthcare data, not all encryption solutions are created equal. Hardware-based encryption offers superior protection compared to software-based alternatives, particularly against sophisticated attacks and tampering attempts. This becomes especially key when transferring sensitive data on external drives.

Modern hardware-encrypted solutions, such as the Kingston IronKey product line, offer robust security features. The Kingston IronKey Vault Privacy 50 USB drive, with its FIPS 197 certification (pending), provides protection against BadUSB through digitally signed firmware and includes brute force attack prevention.

For larger storage needs, the Kingston IronKey Vault Privacy 80 external SSD offers FIPS 197 certified XTS-AES 256-bit encryption with capacities of up to 7.68TB. Its OS-independent design and touch screen interface make it ideal for secure data storage and transfers in healthcare settings. It is especially useful for small-to-medium facilities as it can provide an air-gapped backup that can protect against ransomware, and lead to faster recovery from any disruption.

Steps for protecting patients’ data

While the decreased cost of data breaches in healthcare might suggest progress, the industry must maintain vigilance in implementing comprehensive cybersecurity measures. The protection of sensitive patient information requires a multi-faceted approach combining:

• Strong hardware encryption for data storage and transfer
• Regular staff training on security practices and establishment of cybersecurity hygiene
• Comprehensive planned security strategies rather than ad hoc solutions
• Prompt compliance with evolving regulations
• Investment in specialised cybersecurity expertise to address the skills gap in the industry

By taking these steps, healthcare organisations can better protect their patients' data and maintain the trust essential to providing effective care. Protect your healthcare data with the right encryption. Get expert advice from Kingston’s Ask an Expert team.