Financial records continue to be far more lucractive on the darkweb markets than medical information, although healthcare organizations must be alive to the dangers of exploit kits, malicious insiders and attacks targeting IP, according to Intel Security.
The security giant’s latest McAfee Labs Health Warning puts paid to the suggestion that patient identifiable information (PII) is now as in demand as financial data.
It claimed stolen medical records retail on the cyber underground at between $0.03 and $2.42 – far less than comparable financial account records ($14-$25).
This is despite the fact that health records ‘last’ much longer than more time-sensitive financial data which usually has a very short shelf life before victims are made aware of what’s happened.
“Liquidity trumps longevity in the race to monetize stolen data,” said Raj Samani, Intel Security EMEA CTO.
“If I steal a million credit or debit card numbers, I can quickly sell this digital merchandise before banks and retailers discover the theft and cancel these numbers. Alternatively, a million medical records contain a rich cache of permanent PHI and personal histories, but such data requires a greater investment of time and resources to exploit and monetize it.”
That’s not to say that there’s zero risk to healthcare firms, however, with the Identity Threat Resource Center claiming that healthcare accounted for nearly half (48%) of all breached records so far in 2016 – the largest of any industry in the US.
In fact, Intel Security warned that so-called cybercrime-as-a-service is helping hackers to launch data theft raids on such organizations, for example by enabling rental of exploits and exploit kits to less tech-savvy criminals.
Healthcare organizations should also be on the lookout for malicious insiders, given the resources the black hats are putting into recruiting those with access to sensitive data, the report claimed.
Also, extra effort should be made to protect sensitive IP – which appears to be in higher demand than patient data.
“Corporate espionage has gone digital along with so many other things in our world,” Samani said. “When you consider that research and development is a tremendous expense for these industries, it should be no surprise that cyber-criminals are attracted to the ROI of this category of health care data theft.”