Ransomware basics

Ransomware is a serious form of cyber extortion that employs malware to prevent users from accessing their systems or data, either by locking the system or encrypting critical files until a ransom is paid. The hacker holds the key to unlock the system and usually demands payment in cryptocurrency.

Ransomware has been a known cyber threat vector for over a decade. In recent years, hackers have embraced increasingly sophisticated methods to exploit vulnerabilities and introduce ransomware into systems. They have also expanded the scope of impact by targeting enterprise-wide systems and databases, crippling many companies across industry sectors, including healthcare. Recently, the Federal Bureau of Investigation (FBI), U.S. Department of Health and Human Services (HHS) and the Federal Cybersecurity and Infrastructure Security Agency (CISA) released a report calling attention to the rampant ransomware activity targeting the healthcare sector.

Lessons learned from impact in healthcare

Ransomware affects companies of all shapes and sizes across all industry segments, but there have been several high-profile cases where healthcare companies were infected by ransomware and held hostage for millions of dollars in ransom. These companies were temporarily forced to shut down operations, turn away patients, and attempt to work on paper-based records. Ransomware is uniquely problematic in healthcare settings where disruption of IT systems can directly harm patient safety.

The human factor

Human error is still one of the primary reasons ransomware infects systems.

Ransomware attacks typically begin by phishing or spoofing, fooling users into downloading malware by opening infected emails, clicking on attachments, or visiting illegitimate webpages. Hackers similarly entice users to click on catchy banner ads that may appear legitimate, but actually trigger a download of ransomware. One predominant example of ransomware is called “Ryuk” and you can read about how it works here.

Requested ransom has been known to vary greatly, and can increase dramatically depending on the target and sensitivity of the systems or files that have been encrypted.

What can you do to protect…