Patient critical – healthcare’s cybersecurity pulse

August 2019 News & Events, Information Security, Healthcare (Industry)

The healthcare industry has become one of the leading cybersecurity attack vectors worldwide.

Case 1 – The patient and his family appeared horrified. What had begun as a seemingly routine medical examination had turned into a nightmare. The man appeared healthy but had complained of persistent headaches. The CT scan showed what was diagnosed to be a massive tumour on the brain. Declining surgery, he still managed to get a substantial disability pay-out from his insurers who were unaware of his brilliance at writing computer programs.


Craig Rosewarne

Pending his nomination he undertook a thorough medical check-up and was declared fit as a fiddle. A month later he collapsed at a fundraising function and died of a major arterial embolism in the brain. The underworld rejoiced.

Do the above case scenarios sound strange? Not if one considers that researchers in Israel recently announced that they’d created a computer virus capable of adding or removing images of tumours into CT and MRI scans, malware designed to fool doctors into misdiagnosing low- to high-profile patients. This short video is scary yet fascinating: www.youtube.com/watch?v=_mkRAArj-x0&feature=youtu.be

The healthcare industry has become one of the leading attack vectors worldwide for several reasons. Firstly, it maintains huge amounts of highly sensitive patient data, a juicy target for hackers who can use it for financial gain, humiliation or revenge. Access to a medical database would allow a miscreant to alter medical records, delete them or hold them hostage using ransomware.

Secondly, medical institutions are far more likely to accede to ransomware demands when patients’ lives are at stake. The healthcare industry increasingly relies on IoT (Internet of Things) technology that’s connected to the Internet, which ranges from patient records and lab results to radiology equipment. Even catering and down to maintenance of the hospitals are impacted. The 2017 WannaCry ‘epidemic’ caused chaos in the healthcare industry, the UK in particular being hard hit. Many institutions were found to still be running their systems on outdated, end-of-life, unpatched Windows XP devices.

Healthcare lags far behind other industries, experts say, unlike the financial sector, in the way it protects its information technology infrastructure. A healthcare failure can end with injury or even death, unlike finance which may involve a slap on the wrist or a fine.

Not a matter of when or if…

Medical institutions are being bombarded with malicious attacks every day. Many do not even know that they are already infected as many viruses can lay dormant or continue to seek new backdoors until activated. Advanced Persistent Threats (ATPs) are sometimes only discovered 18 months after breaching the system. Another major problem is that most medical personnel do not know what system devices are running on. Many service providers have gone out of business and patches, when provided, are often not implemented. Many small medical facilities do not have the budget for a full-time IT team and those in rural areas are at greater risk, especially if they are connected to the main urban centres. The country cousins can infect their city slickers – remember, everything is connected.

What other dangers do the health industries and medical devices face? Pacemakers have been proven to be easily hackable. The device can be instructed to speed up, slow down, behave in an erratic fashion or even shut down. ECGs, scanners and X-rays may give false readings or simply be unavailable. Hospitals’ and clinics’ emergency power generators can be disabled, preventing any tests, operations, etc. during a mains outage, which are a common occurrence here in sunny South Africa.

Why is the health industry lagging behind other enterprises? Low budgets play a major part, but the lack of awareness regarding the enormity of the threats from governments, decision makers down to grass-level employees is extremely worrying. The perceived attitude that no-one would be so callous as to attack a medical establishment and endanger human lives or cause fatalities is pervasive. Many hackers don’t care. The monetary rewards far outweigh any feelings of guilt or remorse.

There is a pulse, but it is very weak.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
The power of PKI and private sector innovation
Access Control & Identity Management News & Events Government and Parastatal (Industry)
At the recent ID4Africa 2025 Summit in Addis Ababa, the spotlight was firmly on building secure, inclusive, and scalable digital identity ecosystems for the African continent.

Read more...
Bosch Security renamed Keenfinity
News & Events
Globally renowned brands for video systems, access control and intrusion alarm systems, as well as communication systems, unite under the roof of the new company Keenfinity Group.

Read more...
2025 video surveillance market set for improved fortunes
News & Events Surveillance
Novaira Insights has unveiled its latest report, World Market for Video Surveillance Hardware and Software – 2025 Edition, forecasting a healthy growth rate of 8,1% until 2029, excluding China.

Read more...
Wialon announces integration with fleet maintenance and optimisation platform
News & Events Transport (Industry) Logistics (Industry)
Fleet management software platform integrates with a fleet maintenance and optimisation platform to support mutual customers for better workflows and deeper insights into fleet operations.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Value and industry insight
Securex South Africa Training & Education News & Events
Securex South Africa 2025, co-located with A-OSH EXPO, Facilities Management Expo, and Firexpo, drew thousands of security professionals from across the continent and beyond, offering a platform for networking, product discovery, and knowledge sharing.

Read more...
Gallagher Security achieves ISO 27001 recertification
News & Events Training & Education
Gallagher Security has successfully achieved certification to the updated ISO/IEC 27001:2022 standard for Information Security Management Systems (ISMS). This accomplishment builds on previous certifications and reflects a continued commitment to the highest standards of information security.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.