The Vastaamo case is also a reminder that cyber attacks and data misuse are becoming increasingly rampant and, with them, critical consequences. Ransomware attacks have increased by 50% in the last three months.1 Hacking and ransomware attacks on health information have long been on the rise, tormenting health care providers. In October, six different hospitals were attacked simultaneously in the United States, and by the end of July this year, 40 million patient records have been stolen in more than six hundred different data breaches. Attacks on patient data are only part of the growing data leakage problem.
The case has raised the question of whether the sensitive health information of Finnish people is sufficiently protected and whether companies and organizations operating in the healthcare sector and the applications in use have been audited. HUS, The Hospital District of Helsinki and Uusimaa, introduced a new Apotti customer and patient information and ERP system for the entire Meilahti hospital area. Since its introduction on October 31, 2020, all HUS hospitals are now using the Apotti system, which increased the number of users from about 10,000 to just over 20,000, as well as the customer base to nearly two million.2 To ensure Apotti’s security, everything has presumably been completed with the highest level of expertise, but 100% digital security does not exist. It is good to keep in mind that in 2018 there was an attack on the Norwegian healthcare system, where the customer data of up to three million people were breached.3 The growing number of users alone significantly increases the insider risk and the possibility for human error.
Learning from the past to improve the future
For Finland, the Vastaamo case is too significant of a crisis to waste. However, should the crisis have to be so big for one to realize the importance of investing adequately in cybersecurity and overall corporate security, and for the management of a company to understand the importance of cyber risk analysis for business continuity?
It is a known fact that it is much more difficult to remedy the repercussions than to deal with the actual cyber crisis. Even in the Vastaamo case the leaked data will not be recovered. The information is likely to have already been sold or will be sold to the highest bidder. The patient data that has been published online has probably already spread to the digital world.
Health data differs from credit card and personal data records in that it retains its value regardless of resale. Health data does not expire. Therefore, it is especially valuable on the black market. Of course, comprehensive health data would also have a lot of commercial or research value. Even if the health information is not used in Finland, it does not mean that it could not be used elsewhere.
Unfortunately, the biggest winners in this crisis are the intelligence organizations that collect data in our country. They have gained valuable information and understanding of how Finnish society operates in such a crisis situation. One must learn as much as they can from a crisis like this and translate it into action at national, company and individual level. Hopefully, every company and organization that handles sensitive information will review its own security policies and correct deficiencies in their own systems and operations. This unfortunate case provides an opportunity for the development of a Finnish cybersecurity culture, which is built on a series of small forward-looking development measures.
The number of data leaks is on the rise
The world will continue to see major data breaches in the future unless the level of security improves. Healthcare organisations are a growing target. One reason for the increase in attacks is presumably the sophistication and automation of cybercrime. Ransomware-as-a-Service services are available to anyone and can be purchased for a small fee. There is a huge aftermarket for stolen data. Here are just a few examples of recent cyber attacks:
- More than 23,000 hacked databases were published for download on several different hacking forums.4
- A hacker is selling 34 million user records stolen from 17 different companies.5
- There have been 194 coronavirus-related cyber attacks in the UK. 6
- In 2020, a total of more than 8.3 million people’s information has been stolen in the largest healthcare data leaks.7
Key takeaways
- Every crisis is also an opportunity. Let’s not waste the possibilities to learn from the Vastaamo case.
- Information security and crisis communication is a big strategic issue for the company, which should be taken into account by the management.
- The repercussions of cyber attacks can be much more dramatic than the attack itself.
- A cyber attack life cycle from preparation, to attack and data exploitation can take a long time, even years. Therefore, preparing for cyber attacks must also be a long-term and planned exercise.
Featured in Sectra Newsletter, November 2020
