As telehealth use has skyrocketed throughout COVID-19, so has the number of attacks on these systems by cyber thieves, according to a new report from cybersecurity rating firm SecurityScorecard and dark web research company DarkOwl. Attacks on similar video services, like Zoom, were headline news earlier this year, too, at the height of the economic shutdown caused by the pandemic.
As organizations moved to remote environments or offered services through telecommunications, these technologies have become honeypots to cybercriminals.
Researchers analyzed security alerts sent to IT staff at 148 of the most popular telehealth applications and found they increased by as much as 30% earlier this year, from March through April. This period was compared to September 2019 through February 2020.
In healthcare, a 77% decrease in “IP reputation security alerts" was reported. Telehealth vendors reported an increase of 117%.
The study suggests that cybercriminals have (possibly for the time being) moved on from attacks on health systems and are moving to vendor-support technologies that serve these health systems.
"Though less time passed, those two short months saw a massive increase in weaknesses. Security alerts in the months prior were present but relatively static compared to what happened during the usage spike. Third-party apps, like telehealth apps, increase any healthcare organization's overall digital footprint, which in turn increases the attack surface," Alex Heid, chief R&D officer at SecurityScorecard, said.
The 30% increase in overall cybersecurity findings includes a range of different attack methods, including a 65% increase in patching cadence findings, one of the primary security policies to protect data, and a 56% increase in endpoint security findings. Hackers exploit vulnerabilities in endpoint security to steal data.
Likewise, as people continue moving their lives to remote solutions, more cyberattacks will impact lives, especially those who are less tech-savvy. For example, Google announced it saw 18 million daily COVID-19 phishing attacks and malware threats via email in a single week.
Researchers at Proofpoint recently discovered scams directed at healthcare providers, with new malware called RedLine Stealer that grabs information about a user's system and stored browser details, including passwords and credit card information.
Booz Allen notes that telehealth use likely won't fade after the pandemic, so security must remain a priority for vendors, health systems, and patients. Telehealth “holds the potential to improve medical service delivery, lower the cost of healthcare, enable better home management of health conditions, eliminate the hassle of frequent office visits, and more,” Booz Allen noted, “but these benefits will require health organizations to store and process far more data, and greatly expand their digital infrastructures. To keep their patients, data, and IT systems safe in this environment, they must keep security among their top priorities.”
Cybercriminals are likely already profiting from security vulnerabilities in our young and rapidly developing telehealth system, Booz Allen notes.
Analysts with SecurityScorecard and DarkOwl also found a notable increase in hacker chatter on the dark web about the top 20 telemedicine companies from January through April.
The report looked at 1 million organizations, including more than 30,000 in the healthcare industry, to assess cybersecurity risk.
Many healthcare companies have suffered breaches during the pandemic that likely included patient data or diagnostic research.
For patients, they should steer clear of messages such as: "Dear Patient, please submit this survey to give feedback about your recent telemedicine visit."
Instead, an authentic message might instead read, "Dear [full patient name], please submit this survey to give feedback about your telemedicine visit on [date] with [physician's name]."
