Supply of healthcare data is outstripping demand which has led to a drop in the price of health data on the darknet, according to studies conducted by the World Privacy Forum and the Institute for Critical Infrastructure Technology.
The research suggests the average price of a full set of health records was between $75 to $100 per set last year. The price has now fallen to between $20 to $50 per set of records, which means a sizable fall in income for cybercriminals.
While it used to be possible to sell data easily on darknet marketplaces, the sheer volume of stolen healthcare records makes it much more difficult to do so, and much harder to make money. Cybercriminasl have had to respond by converting stolen data into identity theft kits – combining stolen EHR records with other data and documentation that allows criminals to easily take over identities.
While it is good news that it is now harder for cybercriminals to make money by stealing healthcare data, that is unlikely to result in fewer attacks. In fact, some cybersecurity experts are predicting the fall in the price of health records is likely to result in an increase in attacks on healthcare organizations.
In order to recoup losses from the sale of health records, cybercriminals will have to perform more attacks or larger attacks that result in bigger hauls of data. The fall in the price of health data is also likely to see some criminals change tactics, but attacks on healthcare organizations are unlikely to stop. The industry will just be targeted in a different way.
Pam Dixon, founder and executive director of World Privacy Forum, “There’s been a long trend of identity theft, and that’s still going to be a predominant threat as healthcare files become less profitable over time.” Dixon believes that while data will continue to be stolen for ID theft, instead of targeting healthcare organizations for EHR data, many cybercriminals are likely to turn their attention to ransomware to make money. If it is not possible to sell stolen data easily, money can be made from encrypting data and holding healthcare organizations to ransom.
Attacks on healthcare organizations will continue for as long as it proves profitable to do so. Profits may have fallen, but not yet to the level when they are no longer worthwhile performing. With the threat of even more attacks, healthcare organizations must respond by making it harder for hackers to break through their defenses to gain access to data. They must also ensure that protections are put in place to defend against ransomware attacks, or at least to ensure that data can be recovered without paying a ransom.