Report: Ransomware attacks hit one-third of healthcare organizations in past year

As the recent attack on the Colonial Pipeline illustrates, hackers are using ransomware to disrupt key industries around the world.

According to a new report from cybersecurity company Sophos, a global survey of IT decision-makers across several industries found that 34 percent of healthcare organizations were hit by ransomware attacks in the past year, while 41 percent reported no such attacks but expect to be hit by an attack in the future. Only 24 percent of healthcare organizations say they had not been attacked within the last year and do not expect to be hit by an attack in the next year.

Amongst the industries represented in the survey, healthcare organizations fared relatively well compared to retail and education which reported 44 percent had been attacked. The report says that health organizations’ obligations to make such attacks public make it seem that they are more prevalent than attacks on other industries which may not disclose the information publicly.

Of those attacked, 65 percent said that the hackers were able to encrypt their data in the most significant attack. Of those respondents, 44 percent used backups to restore the encrypted data. Meanwhile 34 percent of organizations who had their data encrypted paid the ransom to get it back, but on average only 69 percent of the encrypted data was restored after the ransom was paid, according to the report.

The report found that 89 percent of healthcare organizations have a malware incident recovery plan. This is good, as the average cost of rectifying a ransomware attack could be $1.27 million, considering the downtime, people time, device costs, network costs, lost opportunities, and the cost of the ransom.