During 2020, the healthcare sector was strongly concentrated on by groups of hackers who gained a benefit due to the pandemic as they attacked those dealing with hospitals administering care to those suffering from the disease.
A massive ransomware campaign targeted one of the biggest healthcare suppliers in the United States. Universal Health Services, an American Fortune 500 company which has a staff of 90,000 people and runs 400 acute care hospitals, was impacted by a huge ransomware attack in September which damaged all of its hospitals. Staff were forced to work using pen and paper for three weeks while it repaired the damage by the attack.
Another illegal infiltration of the University of Vermont Medical Center databases during October impacted over 5,000 hospital computers and laptops and 1,300 servers. All devices had to be have their data removed and have software and data installed again, with the healthcare provider suffering downtime for longer than two months. During the retrieval process around $1.5 million was being lost per day to attack-linked expenses and lost business, with the total costs thought to be more than $64 million.
Ransomware attacks on the healthcare sector increased during September and October and continued to be an issue for the sector for the rest of the year. A research study by Tenable found that ransomware attacks accounted for 46% of all healthcare data breaches in 2020, displaying the extent to which the industry was focused on.
Most of these attacks included the exploitation of unpatched flaws, most commonly flaws in the Citrix ADC controller and Pulse Connect Secure VPN. Patches had been made available the beginning of the year to fix the vulnerabilities, but the patches had not been applied swiftly. Phishing emails also gave ransomware groups the access to healthcare networks they needed to carry out ransomware attacks. Check Point’s research shows there was a 45% increase in cyberattacks on the industry from the start of November to the conclusion of the year.
Another industry heavily targeted by hackers in 2020 was retail. As many different governments issued directives for citizens to remain home to curb the spread of the virus, online retailers saw a sales surge as shoppers made their purchases online rather than in physical stores. Experts at Salesforce saw that digital sales grew by 36% in 2020 compared to the previous year, and cybercriminals took advantage of the increase in digital sales.
Many methods were used to obtain access to retailers’ systems and websites, with the most witnessed tactic being web application attacks, which increased by 800% in 2020 according to the CDNetworks State of Web Security H1 2020 Report. Hackers also used details illegally taken in previous data breaches to attack online retail outlets in credential stuffing attacks, which Akamai’s tracking revealing the retail sector was the most focused on sector industry using this attack technique, account for around 90% of attacks.
As is typical every year, the large amounts of shoppers that head online to complete purchases in the run up to Black Friday and Cyber Monday were exploited, with phishing attacks linked to these shopping events increasing thirteenfold in the six-week time period before Black Friday. In November, 1 in every 826 emails was an online shopping related phishing campaign, as opposed to 1 in 11,000 in October, according to Check Point. Content management systems used by retailers were also targeted, and attacks on retail APIs also grew during 2020.
As 2021 begins, both sectors are likely to go on being heavily focused on. Ransomware and phishing attacks on healthcare suppliers could well grow now that vaccines are being rolled out, and with many consumers still choosing to buy online rather than in person, the retail sector looks set to have another bad 12-month period.
Luckily, by using cybersecurity best practices it is possible to obstruct most of these attacks. Patches need to be applied quickly, especially any flaws in remote access software, VPNs, or popular networking equipment, as those vulnerabilities are rapidly targeted.
An advanced anti-phishing solution needs to be configured to prevent phishing attacks at source and ensure that malicious messages do not land in inboxes. Multi-factor authentication should also be put in place on email accounts and remote access solutions to obstruct credential stuffing attacks.
A web filter is vital for preventing the web-based component of phishing and cyberattacks. Web filters stop staff members from accessing malicious websites and block malware/ ransomware installations and C2 callbacks. And for retail in particular, the use of web application firewalls, safeguard transaction processing, and the proper use of Transport Layer Security across a website (HTTPS) are crucial.
By adhering to cybersecurity best practices, healthcare suppliers, retailers, and other targeted sectors will make it much harder for hackers to gain a profit. TitanHQ can help with SpamTitan Email Security and WebTitan Web Security to safeguard against email and web-based attacks in 2021. To find out more on these two products and how you can use them to safeguard your databases, call TitanHQ now.