Healthcare Cybersecurity

DOJ Indicts 2 REvil Ransomware Gang Members: State Department Now Offering $10 Million Reward for Information

Posted by HIPAA Journal

The United States Department of Justice (DoJ) has unsealed indictments charging two individuals for their roles in multiple REvil/Sodinokibi ransomware attacks on organizations in the United States.

Ukrainian national, Yaroslav Vasinskyi, 22, has been indicted on multiple charges related to the ransomware attacks, including the supply chain attack that saw Kaseya’s Virtual System/Server Administrator (VSA) platform compromised. That attack involved ransomware being deployed on the systems of around 40 managed service providers and 1,500 downstream businesses.

Russian national, Yevgeniy Igoryevich Polyanin, 28, has been indicted for his role in multiple ransomware attacks, including attacks on government entities in Texas. The DoJ says it seized $6.1 million in ransom payments that were paid to cryptocurrency wallets linked to Polyanin.

The DoJ has indicted several individuals believed to have been involved in cyberattacks in the United States; however, those individuals can only face trial if they are located, arrested, and extradited to the United States. Many ransomware threat actors are believed to reside in Russia, where there is no extradition treaty, so there is little chance of them facing justice unless they leave Russia.

International arrest warrants have been issued for both individuals and Vasinskyi was arrested in October at the Polish border. Poland signed an extradition treaty with the United States in 1996 and the U.S. is currently seeking Vasinskyi’s extradition. Polyanin has yet to be apprehended.

“Ransomware can cripple a business in a matter of minutes. These two defendants deployed some of the internet’s most virulent code, authored by REvil, to hijack victim computers,” said Acting U.S. Attorney Chad E. Meacham for the Northern District of Texas. “In a matter of months, the Justice Department identified the perpetrators, effected an arrest, and seized a significant sum of money. The Department will delve into the darkest corners of the internet and the furthest reaches of the globe to track down cybercriminals.”

State Department Offers $10 Million Reward for Information on Leaders of REvil and DarkSide Ransomware Operations

Individuals with information about Polyanin, other leaders of the REvil and DarkSide ransomware groups, or affiliates who conducted attacks, are being encouraged to come forward. The U.S. State Department has announced a reward of up to $10 million for information about that leads to the identification or location of leaders of the REvil/DarkSide ransomware groups, with up to $5 million paid for information that leads to the arrest and conviction of any individual who conspired to participate or attempted to participate in a REvil/DarkSide ransomware attacks. The size of the rewards being offered for information clearly shows how focused the United States is on bringing ransomware threat actors to justice.

The pressure being put on ransomware gangs appears to be having some effect. Chris Inglis, U.S. National Cyber Director, recently told House lawmakers that there has been a discernable decrease in Russia-based cyberattacks. and the DoJ says it expects there to be several more arrests in relation to the REvil and DarkSide ransomware attacks in the coming weeks.

Global Law Enforcement Effort Results in Multiple Arrests

The United States is not the only country to be laser-focused on bringing ransomware threat actors to justice. An international law enforcement operation dubbed GoldDust involving 17 nations has recently resulted in the arrest of 7 hackers believed to be involved in the REvil and GandCrab ransomware operations. The Europol, Eurojust, and INTERPOL-coordinated operation saw three individuals arrested in South Korea, two in Romania, one in Kuwait, and one in an unnamed European country, with the latest takedown occurring on November 4 in Romania and Kuwait.

The three individuals in South Korea were previously arrested in February, April, and October for their role in the GandCrab ransomware attacks, which is believed to be the predecessor of REvil/Sodinokibi. The GoldDust operation has been active since 2018 and was launched in response to the GandCrab ransomware attacks.

The previous week, Europol announced 12 individuals had been arrested in raids in Ukraine and Switzerland over their suspected involvement in ransomware attacks involving LockerGoga and other ransomware attacks. Those individuals are believed to have had specialist roles in various stages of the attacks, from infiltration to cashing out and laundering millions in ransom payments.

In September, a French National Gendarmerie, Ukrainian National Police, Europol, and INTERPOL operation resulted in the arrest of 2 individuals suspected to be members of two prolific ransomware operations. That operation also saw $375,000 in cash and luxury vehicles seized, and the asset freezing of $1.3 million in cryptocurrency.

In addition, a 30-month operation, dubbed Operation Cyclone, which involved law enforcement agencies in multiple countries resulted in the arrest of 6 individuals believed to be involved in the Clop ransomware operation, with those arrests occurring in June 2021. The operation saw searches conducted at 20 locations and resulted in the seizure of $185,00 in cash and computer equipment suspected of having been used to conduct the attacks. The Clop ransomware gang had conducted many attacks in the United States, including those on the University of Colorado, Stanford Medicine, University of California, and the University of Maryland Baltimore.

While these arrests will cause some disruption to the activities of ransomware gangs, they represent just a fraction of the individuals involved in ransomware attacks, many of whom can be easily replaced. The core members of the ransomware operations are believed to reside in Russia where they remain untouchable.

The post DOJ Indicts 2 REvil Ransomware Gang Members: State Department Now Offering $10 Million Reward for Information appeared first on HIPAA Journal.

HS3: Cobalt Strike Penetration Testing Framework Increasingly Used in Cyberattacks on Healthcare Organizations

Posted by HIPAA Journal

The HHS’ Health Sector Cybersecurity Coordination Center (HC3) has issued a threat brief for the healthcare industry warning about the use of the Cobalt Strike penetration testing tool by cyber threat actors.

Cobalt Strike is a powerful red team tool used by penetration testers when conducting risk and vulnerability assessments, but it can also be abused and is increasingly being used by cyber threat actors in attacks on the healthcare and public health sector.

Cobalt Strike can be used for reconnaissance to gain valuable information about the target infrastructure to allow threat actors to determine the best use of their time when attacking healthcare networks. The system profiler function can be used to discover client-side applications used by a target and provides version information. The system profiler starts a local web server, fingerprints visitors, identifies internal IP addresses behind a proxy, and obtains reconnaissance data from the weblog, applications, and provides information on targets.

Cobalt Strike includes a spear phish tool that can be used to create and send fake emails using arbitrary message templates. If a message is imported, Cobalt Strike will replace links/text and create and send convincing phishing emails and track users that click.

The Beacon tool is used to discover client-side applications and versions and allows the loading of malleable command and control profiles, uses HTTP/HTTPS/DNS to egress a network, and named pipes to control Beacons, peer-to-peer, over SMB for covert communications. Beacon can also be used for post-exploitation and can execute PowerShell scripts, log keystrokes, take screenshots, download files, and spawn other malicious payloads. Cobalt Strike also uses attack packages to allow attacks to progress through their many stages and has the capability to transform innocent files into a Trojan horse.

Cobalt Strike uses browser pivoting, which can be used to bypass 2-factor authentication and access sites as the target. Cookies, authenticated HTTP sessions, and client SSL certifications can be leveraged to hijack a compromised user’s authenticated web sessions. Using the Cobalt Strike team server, attackers can share data, communicate in real-time, and take full control of compromised systems.

Cobalt Strike is a powerful penetration testing tool and since it is an entire framework, it has many more capabilities than most malware variants, which makes it a valuable tool for black hat hackers, and many nation-state hacking groups and cybercriminal organizations have been using Cobalt Strike in attacks on the healthcare sector in the United States.

Given the extent to which the framework is used in cyberattacks, healthcare organizations should work on the assumption that Cobalt Strike will be used in an attack and should therefore focus on prevention and detection strategies and follow the MITRE D3FEND framework.

Cobalt Strike is delivered by many different infection vectors, so defending against attacks can be difficult. There is also no single containment technique that is effective against the framework as a whole.

Cobalt Strike is often delivered via malware downloaders such as BazarLoader, which are often delivered using phishing emails containing malicious Office files. It is therefore important to implement advanced email security defenses that can block phishing threats and provide ongoing security awareness training to the workforce to teach employees to identify malicious messages containing malware downloaders such as BazarLoader.

Threat actors often exploit known vulnerabilities in software and operating systems to gain access to healthcare networks. It is therefore important to ensure a full inventory of devices and software is maintained, and patches or other mitigating measures are implemented to address vulnerabilities promptly. Healthcare organizations should also improve their defenses against attacks abusing their remote access capabilities.

Detecting Cobalt Strike once installed can be a challenge. HC3 recommends using signatures for intrusion detection and endpoint security systems and Yara Rules. Further information can be found in the HC3 Cobalt Strike White Paper.

The post HS3: Cobalt Strike Penetration Testing Framework Increasingly Used in Cyberattacks on Healthcare Organizations appeared first on HIPAA Journal.

3 Medium Severity Vulnerabilities Identified in Philips MRI Solutions

Posted by HIPAA Journal

Three medium severity vulnerabilities have been identified in Philips MRI products which, if exploited, could allow an unauthorized individual to run software, modify the device configuration, view and updates files, and export data, including protected health information, to an untrusted environment.

Aguilar found insufficient access controls which fail to restrict access by unauthorized individuals (CVE-2021-3083), the software assigns an owner who is outside the intended control sphere (CVE-2021-3085), and sensitive data is exposed to individuals who should not be provided with access (CVE-2021-3084). Each of the vulnerabilities has been assigned a CVSS V3 base score of 6.2 out of 10.

The vulnerabilities were identified by Secureworks Adversary Group consultant, Michael Aguilar, and affect Philips MRI 1.5T: Version 5.x.x, and MRI 3T: Version 5.x.x. Aguilar reported the flaws to Philips and a patch has been scheduled for release by October 2022. In the meantime, Philips recommends implementing mitigating measures to prevent the vulnerabilities from being exploited.

The mitigations include only operating the Philips MRI machines within authorized specifications, ensuring physical and logical controls are implemented. Only authorized personnel should be allowed to access the vicinity where the MRI machines are located, and all instructions for using the machines provided by Philips should be followed.

Philips has not received any reports of the vulnerabilities being exploited, nor have there been any reports of incidents from the clinical use of the product in relation to the three vulnerabilities.

The post 3 Medium Severity Vulnerabilities Identified in Philips MRI Solutions appeared first on HIPAA Journal.

Chinese APT Group Compromised Healthcare Organizations by Exploiting Zoho Password Management Platform Flaw

Posted by HIPAA Journal

An advanced persistent threat (APT) actor has been conducting an espionage campaign that has seen the systems of at least 9 organizations compromised. The campaign targeted organizations in a range of critical sectors, including healthcare, energy, defense, technology, and education.

The campaign was identified by security researchers at Palo Alto Networks and while the identity of the hacking group has yet to be confirmed, the researchers believe the attacks were most likely conducted by the Chinese state-sponsored hacking group APT27, aka Iron Tiger, Emissary Panda, TG-3390, and LuckyMouse based on the use of hacking tools and techniques that match previous APT27 activity.

The campaign exploited a critical vulnerability (CVE-2021-40539) in ManageEngine ADSelfService Plus, an enterprise password management and single sign-on solution developed by Zoho. Successful exploitation of the flaw allows remote attackers to execute arbitrary code and take full control of vulnerable systems.

On September 17, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a security advisory warning exploits for the flaw were in the public domain and being used by APT actors to install web shells on vulnerable servers to gain persistent access.

Palo Alto Networks said a second campaign was then identified that involved extensive scans for vulnerable servers using leased infrastructure in the United States. Vulnerable systems that had not been patched against the vulnerability started to be attacked from September 22, 2021, with those attacks continuing throughout October.

The attackers deployed a web shell called Godzilla, with a subset of victims also having a new backdoor called NGlite installed. The backdoor or web shell was then used to run commands and move laterally within victims’ environments, with sensitive data exfiltrated from victims’ systems. When the attackers located a domain controller, they installed a new credential-stealing tool dubbed KdcSponge, and harvested credentials and exfiltrated files such as the Active Directory database file (ntds.dit) and the SYSTEM hive from the registry.

Palo Alto Networks said its scans indicate there are currently around 11,000 servers running the Zoho software, although it is unclear how many of them have been patched against the CVE-2021-40539 vulnerability. The researchers said the APT group attempted to compromise at least 370 Zoho ManageEngine servers in the United States alone.

The post Chinese APT Group Compromised Healthcare Organizations by Exploiting Zoho Password Management Platform Flaw appeared first on HIPAA Journal.

FBI: Ransomware Gangs Exploiting Corporate Financial Events to Facilitate Extortion

Posted by HIPAA Journal

Ransomware gangs often use double extortion tactics to encourage victims to pay the ransom. In addition to file encryption, sensitive data are stolen and a threat is issued to sell or publish the data if the ransom is not paid. The Federal Bureau of Investigation (FBI) has recently issued a private industry notification warning of a new extortion tactic, where ransomware gangs target companies and organizations that are involved in significant time-sensitive financial events, steal sensitive financial data, then threaten to publish that information if payment is not made.

Ransomware gangs conduct extensive research on their victims before launching an attack, which includes gathering publicly available data and nonpublic material. The attacks are then timed to coincide with the release of quarterly earnings reports, SEC filings, initial public offerings, and merger and acquisition activity, with the release of information having the potential to significantly affect the victim’s stock value.

“During the initial reconnaissance phase, cyber criminals identify non-publicly available information, which they threaten to release or use as leverage during the extortion to entice victims to comply with ransom demands,” explained the FBI. “Impending events that could affect a victim’s stock value, such as announcements, mergers, and acquisitions, encourage ransomware actors to target a network or adjust their timeline for extortion where access is established.”

Several ransomware operations are known to steal sensitive data and sift through that information to find potentially damaging material. The REvil and Darkside ransomware gangs have both issued threats to contact stock exchanges such as NASDAQ to advise them about a current ransomware attack and provide damaging information to tank share prices.

“Now our team and partners encrypt many companies that are trading on NASDAQ and other stock exchanges. If the company refuses to pay, we are ready to provide information before the publication, so that it would be possible to earn in the reduction price of shares. Write to us in ‘Contact Us’ and we will provide you with detailed information,” said the Darkside ransomware gang in an April 2021 post on their blog site.

The FBI lists some attacks where companies have been targeted that were undergoing mergers or acquisitions. For example, in early 2020, a ransomware actor with the moniker “Unknown” posted on the Russian “Exploit” hacking forum that a good way to force victims to pay the ransom was to reference their presence on the NASDAQ stock exchange and threaten to leak data to NASDAQ to tank share prices. That advice was followed by several threat actors. Between March 2020 and July 2020, at least three publicly traded US companies that were actively involved in mergers and acquisitions were targeted, two of which were undergoing private negotiations.

Threat actors known to deploy the Pyxie Remote Access Trojan (RAT) before using the Defray777 and RansomEXX ransomware variants were searching for information on victims’ current and near-future stock values in the initial phases of the attacks. A November 2020 analysis of the Trojan revealed keyword searches for terms such as 10-q1, 10-sb2, n-csr3, nasdaq, marketwired, and newswire.

To prevent attacks and ensure data recovery is possible without paying a ransom, the FBI recommends regularly backing up data and storing it offline, installing and regularly updating antivirus software, making sure all software is kept up to date, adopting the least privilege approach and network segmentation, only using secure networks for connections, and implementing multi-factor authentication.

The FBI doesn’t recommend paying a ransom as it emboldens adversaries to target additional organizations, encourages other threat actors to conduct ransomware attacks, and there is no guarantee that payment will result in data recovery. However, the FBI understands that businesses faced with an inability to function will likely evaluate all options to protect their shareholders, employees, and customers. Regardless of the decision taken, the FBI encourages all ransomware victims to report attacks to their local FBI field office.

The post FBI: Ransomware Gangs Exploiting Corporate Financial Events to Facilitate Extortion appeared first on HIPAA Journal.

42% of Healthcare Organizations Have Not Developed an Incident Response Plan

Posted by HIPAA Journal

Hacks, ransomware attacks, and other IT security incidents account for the majority of data breaches reported to the Department of Health and Human Services’ Office for Civil Rights, but data breaches involving physical records are also commonplace. According to the Verizon Data Breach Investigations Report, disclosed physical records accounted for 43% of all breaches in 2021, which highlights the need for data security measures to be implemented covering all forms of data.

The healthcare industry is extensively targeted by cybercriminals and cyberattacks increased during the pandemic. There was a 73% increase in healthcare cyberattacks in 2020, with those breaches resulting in the exposure of 12 billion pieces of protected health information, according to the 2021 Data Protection Report recently published by Shred-It.

The report is based on an in-depth survey of C-level executives, small- and medium-sized business owners, and consumers across North America and identifies several areas where organizations could improve their defenses against external and internal threats.

Healthcare data breaches are the costliest of any industry at an average of $9.23 million per incident and data breaches such as ransomware attacks put patient safety at risk. 62% of healthcare organizations said they thought a data breach would be costly, with 54% saying a data breach would have a major impact on their reputation. 56% of surveyed healthcare organizations said they have previously experienced a data breach, and 29% said they had experienced a data breach in the previous 12 months.

Due to the need to comply with HIPAA, healthcare organizations were better equipped than other industries to prevent and deal with security incidents, with 65% of surveyed healthcare organizations saying they have the appropriate information security tools and resources. While the healthcare industry was significantly more likely than any other industry to have an incident response plan, 42% of respondents said an incident response plan had not been implemented, even though having an incident response plan has been shown to shorten the recovery time and reduce the cost of a data breach.

75% of healthcare organizations said information security is a top priority at their organization, and 61% said they have hired a third-party security expert to evaluate their security practices. However, only 64% employ information security policies, less than half (48%) have regular infrastructure auditing, and only a third (33%) perform vulnerability assessments.

The survey revealed 22% of data breaches were the result of errors by employees. The biggest barriers to employees following information security policies and procedures were a lack of understanding of the threats and risks (49%), lack of accessibility or understanding of policies (41%), and a lack of consistent training and security awareness programs (10%).

While the healthcare industry is better prepared than many other industries, the survey shows there is significant room for improvement. Shred-It suggests healthcare organizations should develop a comprehensive plan covering all data, employ a data minimization strategy, take advantage of the cloud, invest in endpoint detection and response technology, develop an incident response plan, and encrypt all data on-premises, in the cloud, and in transit.

The post 42% of Healthcare Organizations Have Not Developed an Incident Response Plan appeared first on HIPAA Journal.

OCR: Ensure Legacy Systems and Devices are Secured for HIPAA Compliance

Posted by HIPAA Journal

The Department of Health and Human Services’ Office for Civil Rights has advised HIPAA-covered entities to assess the protections that they have implemented to secure their legacy IT systems and devices.

A legacy system is any system that has one or more components that have been supplanted by newer technology and reached end-of-life. When software and devices reach end-of-life, support comes to an end, and patches are no longer issued to correct known vulnerabilities. That makes legacy systems and devices vulnerable to cyberattacks.

Healthcare organizations should be aware of the date when support will no longer be provided, and a plan should be developed to replace outdated software and devices; however, there are often valid reasons for continuing to use outdated systems and devices.

Legacy systems may work well and be well-tailored to an organization’s business model, so there may be a reluctance to upgrade to new systems that are supported. Upgrading to a newer system may require time, funds, and human resources that are not available, or it may not be possible to replace a legacy system without disrupting critical services, compromising data integrity, or preventing ePHI from being available.

HIPAA-covered entities should ensure that all software, systems, and devices are kept fully patched and up to date, but in healthcare, there are often competing priorities and obligations. If the decision is made to continue using legacy systems and devices, it is essential for security to be considered and for safeguards to be implemented to ensure those systems and devices cannot be hacked. That is especially important if legacy systems and devices can be used to access, store, create, maintain, receive, or transmit electronic protected health information (ePHI).

It is not a violation of the HIPAA Rules to continue using software and devices that have reached the end of life, provided compensating controls are implemented to ensure ePHI is protected. “Despite their common use, the unique security considerations applicable to legacy systems in an organization’s IT environment are often overlooked,” said OCR in its cybersecurity newsletter, which would violate the HIPAA Rules.

In healthcare, there may be many legacy systems and devices in use that need to be protected. Healthcare organizations need to have full visibility into the legacy systems that reside in their organization, as if the IT department is unaware that legacy systems are in use, compensating controls will not be implemented to ensure they are appropriately protected.

It is vital for a comprehensive inventory to be created that includes all legacy systems and devices and for a security risk assessment to be performed on each system and device. “The HIPAA Security Rule requires covered entities and their business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI throughout their environment, including ePHI used by legacy systems,” explained OCR in its recent cybersecurity newsletter.

Risks must be identified, prioritized, and mitigated to reduce them to a low and acceptable level. Mitigations include upgrading to a supported version or system, contracting with a vendor to provide extended support, migrating the system to a supported cloud-based solution, or segregating the system from the network.

If HIPAA-covered entities choose to continue maintaining a legacy system existing security controls should be strengthened or compensating controls should be implemented. OCR says consideration should be given to the burdens of maintenance, as they may outweigh the benefits of continuing to use the legacy system and plans should be made for the eventual removal and replacement of the legacy system.

In the meantime, OCR suggests the following controls for improving security:

  • Enhance system activity reviews and audit logging to detect unauthorized activity, with special attention paid to security configurations, authentication events, and access to ePHI.
  • Restrict access to the legacy system to a reduced number of users.
  • Strengthen authentication requirements and access controls.
  • Restrict the legacy system from performing functions or operations that are not strictly necessary
  • Ensure backups of the legacy system are performed, especially if strengthened or compensating controls impact prior backup solutions.
  • Develop contingency plans that contemplate a higher likelihood of failure.
  • Implement aggressive firewall rules.
  • Implement supported anti-malware solutions.

The post OCR: Ensure Legacy Systems and Devices are Secured for HIPAA Compliance appeared first on HIPAA Journal.

Microsoft Warns of Ongoing Attacks by SolarWinds Hackers on Service Providers and Downstream Businesses

Posted by HIPAA Journal

The advanced persistent threat (APT) actor Nobelium (aka APT29; Cozy Bear) that was behind the 2020 SolarWinds supply chain attack is targeting cloud service providers (CSPs), managed service providers (MSPs), and other IT service providers, according to a recent alert from Microsoft.

Rather than conducting attacks on many companies and organizations, Nobelium is favoring a compromise-one-to-compromise-many approach. This is possible because service providers are often given administrative access to customers’ networks to allow them to provide IT services. Nobelium is attempting to leverage that privileged access to conduct attacks on downstream businesses and has been conducting attacks since at least May 2021.

Nobelium uses several techniques to compromise the networks of service providers, including phishing and spear phishing attacks, token theft, malware, supply chain attacks, API abuse, and password spraying attacks on accounts using commonly used passwords and passwords that have previously been stolen in data breaches.

Once access to service providers’ networks has been gained, Nobelium moves laterally in cloud environments then leverages the trusted access to conduct attacks on downstream businesses using trusted channels such as externally facing VPNs or the unique software solutions used by service providers to access customers’ networks.

Some of the attacks conducted by Nobelium have been highly sophisticated and involved chaining together artifacts and access from multiple service providers in order to reach their end target, as indicated in the diagram below.

Example of a Nobelium attack leveraging multiple service providers. Source: Microsoft Threat Intelligence Center

Microsoft Threat Intelligence Center (MSTIC) has made several recommendations for service providers and downstream businesses to help with mitigation and remediation.

CPSs and MSPs that rely on elevated privileges to provide services to their customers have been advised to verify and monitor compliance with Microsoft Partner Center security requirements, which include enabling multifactor authentication and enforcing conditional access policies, adopting the Secure Application Model Framework, checking activity logs and monitoring user activities, and removing delegated administrative privileges that are no longer in use.

All downstream businesses that rely on service providers that have administrative access have been advised to review, audit, and minimize access privileges and delegated permissions, including hardening and monitoring all tenant administrator accounts and reviewing service provider permissions access from B2B and local accounts. They should also verify MFA is enabled and conditional access policies are being enforced and regularly review audit logs and configurations.

Microsoft has published detailed information on the tactics, techniques, and procedures (TTP) of Nobelium in its alerts to help IT security teams to block, detect, investigate, and mitigate attacks.

The post Microsoft Warns of Ongoing Attacks by SolarWinds Hackers on Service Providers and Downstream Businesses appeared first on HIPAA Journal.

Study Reveals Healthcare Employees Have Unnecessary Access to Huge Amounts of PHI

Posted by HIPAA Journal

A new study has revealed widespread security failures at healthcare organizations, including poor access controls, few restrictions on access to protected health information (PHI), and poor password practices, all of which are putting sensitive data at risk.

The study, conducted by the data security and insider threat detection platform provider Varonis, involved an analysis of around 3 billion files at 58 healthcare organizations, including healthcare providers, pharmaceutical companies, and biotechnology firms. The aim of the study was to determine whether security controls had been implemented to secure sensitive data and to help organizations better understand their cybersecurity vulnerabilities in the face of increasing threats.

The Health Insurance Portability and Accountability Act (HIPAA) requires access to PHI to be limited to employees who need to view PHI for work purposes. When access is granted, the HIPAA minimum necessary standard applies, and only the minimum amount of PHI should be accessible. Each user must be provided with a unique username that allows access to PHI to be tracked. Passwords are required to authenticate users, with the HIPAA Security Rule requiring HIPAA-regulated entities to implement, “procedures for creating, changing, and safeguarding passwords.”

The Varonis study, the results of which were published in its 2021 Data Risk Report: Healthcare, Pharmaceutical, & Biotech, revealed an average healthcare worker has access to 31,000 sensitive files containing PHI, financial, and proprietary data on their first day of work. Those files were stored on parts of the network that can be accessed by all employees.

On average, 20% of each organization’s files are open to every employee, even though in many cases access was not required to complete work duties. 50% of organizations investigated had more than 1,000 sensitive files open to all employees, and one in four files at small healthcare organizations could be accessed by every employee. There were no restrictions on access to 1 in 10 files that contained PHI or intellectual property.

“We discovered that smaller organizations have a shocking amount of exposed data, including sensitive files, intellectual property, and patient records. On their first day, new employees at small companies have instant access to over 11,000 exposed files, and nearly half of them contain sensitive data,” explained Varonis in the report. “This creates a massive attack surface and increases the risk of noncompliance in the event of a data breach.”

To reduce risk, it is vital to operate under the principle of least privilege. If employees are given broad access to sensitive information, not only does that increase the opportunity for insider data theft, if their credentials are compromised in a phishing attack, external threat actors will have easy access to huge volumes of data.

The problem is made worse by poor password practices. 77% of companies studied for the report had 501 or more accounts with passwords set to never expire, and 79% of organizations had more than 1,000 ghost accounts. Ghost accounts are inactive accounts that have not been disabled. These accounts give hackers an easy way to access sensitive data and traverse networks and file structures undetected.

According to the Verizon Data Breach Investigations Report, data breaches increased by 58% in 2020 with cyber threat actors actively targeting the healthcare, pharma, and biotech industries to steal sensitive data, intellectual property, and vaccine research data. The healthcare industry has the highest data breach costs which, according to the IBM Security Cost of a Data Breach Report, are $7.13 million per breach. Organizations that fail to restrict access to protected healthcare information can also face heavy financial penalties, which under HIPAA/HITECH are up to $1.5 million per year, per violation category.

“To get in front of increasingly malicious and sophisticated cyberattacks, hospitals, pharmaceutical companies, and biotech’s need to double down on maturing incident response procedures and mitigation efforts,” said Varonis. “Enforcing least privilege, locking down sensitive data, and restricting lateral movement in their environments are the absolute bare minimum precautionary measures that healthcare organizations need to take.”

The post Study Reveals Healthcare Employees Have Unnecessary Access to Huge Amounts of PHI appeared first on HIPAA Journal.