The Hidden Cost of Cyberattacks in Healthcare

The financial cost of cyberattacks in healthcare is astronomical and rising, but the effects extend far beyond the balance sheet. Even as your healthcare company pays an average of $10.93 million USD – the highest among all sectors, and more than twice the $4.45 million average overall – the true costs of a healthcare data breach can be much higher.  

These costs include: 

• Reputation loss, 
• Customer and revenue losses, 
• Business interruptions, 
• Impacts on business partners and the supply chain, 
• Non-compliance penalties, and 
• Rises in cyber insurance premiums. 

Fortunately, preventing and ameliorating cyberattacks in healthcare is possible with the right tools. Read on to learn more. 

Life-Threatening Impacts of recent attacks & breaches

The cost of a healthcare data breach can be higher, and more dire, than in any other industry, affecting not just bottom lines but also lives. 

SingHealth data breach (2018)

A data breach at SingHealth, Singapore’s largest healthcare group, compromised the personal information of 1.5 million patients, including the country’s prime minister, in 2018. Afterward, more than 60 percent of affected customers said they’d lost trust in the provider.  

As a result, the company’s share price dropped 3 percent. Other losses included a 5 to 10 percent dip in brand value, the loss of 15 percent of customers, and 30 percent more negative mentions on social media.  

NHS Cyber Attack (2024)

But cyberattacks in healthcare carry a hidden cost, as well: they can threaten lives. After a 2024 attack on England’s National Health Service, for example, hospitals were unable to match their stores of donated blood with patients who needed it. 

Change Healthcare (2024)

And a 2024 attack on U.S.-based Change Healthcare, one of the world’s biggest health payment processors, shut down healthcare facilities across the US, preventing and delaying care for millions. In that attack, cybercriminals accessed 4 terabytes of sensitive patient and company data, as well. 

That’s on top of the costs to Change Healthcare’s parent company, UnitedHealth. UHG paid $22 million in ransom alone, not to mention legal fees, recovery costs, and other expenses expected to total at least $1.6 billion. 

Why Healthcare Is So Vulnerable 

Cybercriminals have doubled down on the healthcare sector and show no signs of relenting.  

The number of hospital systems hit with ransomware nearly doubled in 2023, to 46, from 25 in 2022, the New York Times reports. Globally, healthcare events globally nearly quadrupled in 2023 over the previous year, the European Repository of Cyber Incidents found.  

Hostile nation-states attack healthcare providers daily, the US House Energy and Commerce Committee Subcommittee on Health learned in a recent hearing. 

Healthcare is highly interconnected

Interconnectedness makes healthcare an especially attractive – and lucrative target. Physicians’ offices, clinics, hospitals, medical devices, laboratories, pharmacies, electronic health records, insurers, support services, and other repositories of healthcare data form a vast, interlocking web of information. Breaching just one of these gains bad actors a treasure trove of valuable data. 

Stolen health records pose an especially juicy target, selling on the dark web for 10 times more than stolen credit card numbers, the American Hospital Association notes. 

Security in healthcare is notoriously lax

The COVID-19 pandemic is partly to blame, the Lancet reports. To provide care during a time of quarantines and lockdowns, facilities rushed to adopt new digital technologies – and often gave short shrift to security. 

And cybersecurity can, itself, be costly, requiring entities to continually update their systems, networks, applications, and digital devices. Lacking time and money, many providers use outdated technologies and software. 

Lives are at stake

A single vulnerability is all attackers need to bring down an entire healthcare system, or even an ecosystem. And with lives at stake, medical providers are much more likely to pay the ransom for the sake of continuing care. 

Proactive Cybersecurity in Health Care 

Nearly all cybersecurity incidents – 95% — begin with human error, the World Economic Forum reports. And, as we’ve seen, even the largest healthcare providers can lack basic cyber hygiene. Improving employee cybersecurity awareness alone could cause many cyberattacks in healthcare to fail. 

Phishing has long been cyberattackers’ most oft-wielded weapon, accounting for one-third of attack types, Hornetsecurity’s recent Cyber Security Report found. Malicious URLs account for 22.7% of attacks. 

Bolstering your front line of defense – your employees – with the knowledge and awareness they need to spot and report these traps can greatly reduce your organization’s likelihood of becoming the next healthcare breach headline. 

---

Hornetsecurity’s comprehensive Security Awareness Service solution can help your healthcare organizations detect, prevent, and respond to threats before they escalate. Our service will help you to 

• Protect sensitive patient data from ransomware and breaches, 
• Reduce human error with targeted employee training, 
• Ensure compliance with healthcare regulations,  
• And more. 

Using next-generation AI technology, Hornetsecurity’s Security Awareness Service provides fully automated e-training, personalized for each individual, that adapts as your team’s knowledge grows.  

Our spear phishing simulations keep your people ever-vigilant and aware of the latest phishing tactics, and our patented ESI^® – Employee Security Index – continuously measures and compares employee security behavior enterprise-wide. 

---

Conclusion – Saving on Seen and Unseen Cyberattack Costs 

The cost of a cyberattack in healthcare, with seen and unseen consequences, is too great to overlook.  

As the number and severity of cyberattacks in healthcare continue to rise, maintaining the status quo isn’t an option. AI is upping the ante, making phishing and social engineering attacks, in particular, more difficult to detect than ever. It’s time to raise awareness for the sake of your people, customers, and business. 

Hornetsecurity’s Security Awareness Service teaches your employees how to secure your critical data and protect your patients. Contact us now for your free demo, and see for yourself how heightened awareness can keep your healthcare company and customers safe and secure.