Cybersecurity in the Laboratory: How Far We’ve Come, Where We Still Have To Go

One of the perils of the digital age, in which hospitals and laboratories rely on digital technologies and network connectivity, is that they are increasingly the target of ransomware attacks by cybercriminals.  

Hospitals and laboratories are big targets because they hold confidential patient data and are frequently vulnerable in their cybersecurity protections. Other healthcare adjacent companies are also becoming targets—such as a recent high-profile breach at Change Healthcare, a subsidiary of insurer UnitedHealthCare.¹ 

Critical Values spoke to experts Toby Cornish MD, PhD, Professor of Pathology and Director of Pathology Informatics at the Medical College of Wisconsin, and Pathology & Laboratory Medicine Informatics Officer at Froedtert Hospital in Wisconsin, and J. Mark Tuthill, MD, Division Head of Pathology Informatics at Henry Ford Health System in Michigan. They explain how far cybersecurity in the laboratory has come in the two years since we last reported on this issue, and where we still need to go to help laboratories and hospitals prevent future attacks.  

Hackers are more sophisticated 

One of the biggest changes in ransomware attacks over the past two years is that the hackers’ strategies have grown more sophisticated, and the volume of attacks and attempts has increased, Dr. Tuthill says. 

Additionally, he says it’s no longer just greedy hackers, in essence, but “bad actors on the international level” who threaten not only laboratories and hospitals but banks and water systems. “It’s cyber warfare,” Dr. Tuthill explains. 

These hackers have gotten very good at identifying what Dr. Cornish calls “soft targets”—organizations that are not as well equipped to prevent attacks. Many hospitals and laboratories fall into this category because they still haven’t made the level of cybersecurity improvements necessary to defend themselves. “A lot of organizations haven’t gotten the memo that they are vulnerable,” Dr. Cornish says. 

From ransoms to blackmail 

As if the increase in attacks isn’t alarming enough, Dr. Cornish says they’re evolving beyond straightforward ransoms, as well. 

“In the past, they were still mostly locking and holding data and you’d pay your ransom to get your data back. Now they’re exfiltrating data and then blackmailing,” he says. So, the ransom is to prevent the selling or release of the data to the dark web, and yet in some cases, even after the ransom has been paid, the data still gets released where it should not. 

“Hacking has gone from a cute adolescent playground of people screwing up your computer to an approach that is highly organized, highly sophisticated, and makes money. This changes the whole game,” Dr. Tuthill adds. 

Hackers have improved infiltration techniques

There are also concerning evolutions in the sophistication of how hackers infiltrate systems, Dr. Cornish says.  

Hackers have been relying for years on “social engineering,” in essence, manipulating people inside of an organization to effectively do the bidding of a malicious actor. In the 1980s, social engineering typically occurred over the phone, but today’s electronic communications have multiplied the number of avenues of attack.  A main hacking practice is to send malicious files via “phishing”—emails that fool you into thinking they’re from a trusted institution or business you frequently use, such as retailers, or even your own bank, asking for your username and password.  

The Trojan Horse approach 

More alarming, the hackers are playing the long game through a virtual Trojan Horse approach, Dr. Tuthill explains. “Malware can sit there and silently grow across your network and become activated at some later period of time or by a remote trigger.” 

This sort of malware can come in via phishing or can even hunker in websites or files that the user isn’t aware of. “They can literally hide out as packets of information in emails, in attachments to emails, and in executable files on emails,” Dr. Tuthill says.