Editor’s intro: A data breach can leave your records vulnerable and patient information open to identity theft. Black Talon Security can help to protect your network from cybercriminals.
Gary Salman sounds an alert: Don’t be held ransom to a data breach that could have been prevented
Ransomware is a type of malicious software or malware, that is designed to deny access to a computer system and/or data until a ransom is paid. An entirely new class of ransomware is being deployed by cybercriminals that encrypts your data, steals your patient records, and creates a “backdoor” for a future attack. It is typically spread through phishing emails, attachments, infected websites, or through hackers injecting it into your network. It is important to understand that for ransomware to hold you hostage, there must be existing software or network vulnerabilities in your system. In our experience, these vulnerabilities have been present in every dental practice due to the fact that IT companies do not have the technology or credentials to properly identify these risks.
Ransomware can be devastating to your practice both from a financial and PR standpoint (including the loss of your patients’ and referral trust). Recovery of data is a difficult process and may require the assistance of a reputable cybersecurity specialist. In addition, the HIPAA Privacy Rule (See 45C.F.R. 164.400-414) and many state laws require the practice owner to prove, with low probability, that electronically protected health information (ePHI) was neither accessed nor stolen by the cybercriminal. A forensic investigation performed by a cyber-security company is the only way to determine whether or not ePHI was compromised.
One of the biggest mistakes that we see practices make is relying on their IT company for cybersecurity and believing that “my IT guy does this.” Every dentist and specialist we have worked with who has been the victim of a data breach also had an IT company that they thought was protecting them. As the owner of the practice, understanding your risk should be a top priority for protecting your data. It is important to remember that IT companies are not cybersecurity companies and do not have the same knowledge and/or expertise as a specialist in cybersecurity.
Many cloud-based practices have a false sense of security when it comes to this new cyber threat. In August 2019, one of the most devastating ransomware attacks on a medical records backup service impacted more than 400 dental practices across the United States. While using cloud-based software can be more secure, there is always the concern of malware moving from your local network into the cloud or vice versa. This attack was launched not only against a cloud-based software, but also through its managed service provider (MSP)/IT vendor.
We have recently been involved in data breaches with several practices where the IT vendors were the initial targets. Cybercriminals know that IT companies store user names and passwords to their clients’ data. Once they have this information (the “keys to your castle”), it’s easy for them to gain access to your network and compromise the data in your practice. It is important to understand that the days of simply relying on firewalls and antivirus software to keep hackers out of your network are over. If these devices were so effective at protecting data, there would be no data breaches. With the continued sophistication of cybercriminals, they can now deliver payloads that completely disable your antivirus software and allow unauthorized access to your network. Make no mistake: As practicing dentists, you are actively being targeted by cybercriminals with the intent of stealing your valuable patient data. Your patient records include all of the information that a cybercriminal needs for identity theft. A single patient record sells for as much as $50 on the “dark web” (the black market for hackers). In addition to identity theft, hackers are extorting practitioners for ransom payments. Black Talon Security has been involved in breach cases with ransoms ranging from $4,000 to $1.4 million.
Predictive threat intelligence
Black Talon Security is now deploying the next generation of advanced cybersecurity tools. At the 2019 American Association of Oral and Maxillofacial Surgeons (AAOMS) meeting in Boston, we introduced Predictive Threat Intelligence (PTI). This new game-changing technology will help us identify the “unlocked doors and windows” on your network on a real-time basis. This is a significant development for your cyber defense as this automated tool acts as a “news feed” to alert us to the latest vulnerabilities that could affect various devices on your network. Our new PTI tool knows vulnerabilities that have been successfully exploited by hackers worldwide and provides us with an instant alert should one of these vulnerabilities ever appear on your network.
Being proactive:
Educating doctors and staff members about current threats has significantly reduced the number of cyber-attacks in practices by more than 75%. Don’t fall victim to these cybercriminals, and don’t think this will never happen to you.
It’s not IF it will happen to you, but WHEN.
A data breach can result in implanted malware in your network. Read about taking some defensive measures here.
