Increased ransomware threat for hospitals and healthcare providers prompt promises of EU action

Europe is not only menaced by Russian aggression, but also ransomware criminals attacking vulnerable hospitals and healthcare providers. A number of recent attacks by ransomware gangs have severely disrupted healthcare provision in several European Union countries, as the criminals attempt to extort money in return for not publicising sensitive personal information on patients.

The issue has understandably become a political hot potato, with Europeans demanding action to halt the frequent and dangerous attacks on the continent's health care. Now, the former, and recently re-elected, President of the European Commission, Ursula van der Leyen is promising to do something about it.

"We must also do more to protect the security of our health systems, which are increasingly the target of cyber and ransomware attacks. To improve threat detection, preparedness and crisis response, I will propose a European action plan on the cybersecurity of hospitals and healthcare providers in the first 100 days of the mandate," von der Leyen wrote.

What the plan will look like and how effective it will be remains to be seen, as few measures so far have been able to seriously make a dent in the volume of ransomware attacks.

An expanded sanctions framework looks set to be put in place, and increased cooperation between countries like the International Counter Ransomware Initiative have had some success over the past years, but the threat has not subsided, with criminals moving to a successful as-a-service model under which associates can buy or rent malware for attacks.

It is clear that increased funding for targeted healthcare providers is needed to ensure they become more resilient against attacks, but this would require political will to implement a modernisation of the institutions' technology, which is often outdated and vulnerable.

Ransomware attacks on healthcare service providers can have absolutely devastating effects that could threaten the lives of patients. Britain's National Health Service (NHS) is struggling with the consequences of a ransomware attack by the Russia-based Qilin gang in June on pathology services provider Synnovis.

Thousands of patients appointments and procedures had to be postponed, with hospital services operating at much lower capacity than usual and blood stocks running low.

It would be wrong to think ransomware attacks are limited to particular geographies. New Zealand suffered an attack in 2021 on the Waikato District Health Board in 2021, with data being encrypted and digital system functions interrupted.

Across the Tasman, another healthcare related ransomware attack continues to create concern. Enterprise IT publication iTnews reported that around information on 12.9 million Australians was breached by criminals that attacked electronic prescriptions provider MediSecure.

The ransomware raiders stole a vast amount, 6.5 terabytes, of personal and health data, in April from a database on a server that was encrypted. As anyone can imagine, health data is extremely sensitive personal information; remarkably, all that data was "semi-structured" and "unstructured" so MediSecure wasn't sure what it contained.

Soon after the attack, MediSecure went into voluntary liquidation as the Australian government refused to help with funding to deal with the ransomware catastrophe.