- Pharma Maker Disputes Data Compromise Amid Reported Rise In Sector Attacks
By Marianne Kolbasuk McGee (HealthInfoSec)
Drugmaker Novartis says no sensitive information was compromised in an alleged incident involving a hacking group that claims to have stolen company data “directly” from the laboratory environment of a manufacturing plant.
The alleged incident involving Novartis is among the latest examples of rising cyberattacks on healthcare sector entities and comes amid warnings to the industry by federal authorities about certain threat actors.
A new report by security firm Sophos finds that 66 per cent of healthcare organization respondents acknowledge that their organizations were hit by ransomware in 2021, up from 34 per cent in 2020.
The 94 per cent increase in ransomware attacks on healthcare sector entities over a one-year period “demonstrates that adversaries have become considerably more capable at executing the most significant attacks at scale,” the report says.
In addition, the Department of Health and Human Services’ Health Sector Cyber Coordination Center, or HC3, issued an advisory last week about the “return” of Emotet malware as an infrastructure-as-a-service offering used by cybercriminal groups as a vehicle to drop ransomware, data exfiltration and related attacks on healthcare sector entities.
Emotet first emerged around 2014 as a banking Trojan. The Emotet botnet was disrupted in early 2021 by US, Canada and European law enforcement agencies but began to resurface by the end of the year, HC3 says.
Novartis Incident
Extortion group Industrial Spy on its dark web Tor marketplace last week allegedly posted for sale for US$500,000 in bitcoins data it claims was stolen from Novartis, including “latest RNA and DNA-based drug technology” stolen from a laboratory environment of a company manufacturing plant, according to news site Bleeping Computer.
The data Industrial Spy claims was stolen from Novartis and posted for sale on the group’s dark web marketplace includes 7.7MB of PDF files containing data related to next-generation technology used in the development of COVID-19 vaccine variants and genetic cancer therapy Kymriah, according to Bleeping Computer.
The pharmaceutical company, in a statement provided to Information Security Media Group, says: “Novartis is aware of this matter, we have thoroughly investigated it and we can confirm that no sensitive data has been compromised. We take data privacy and security very seriously and have implemented industry standard measures in response to these kind of threats to ensure the safety of our data.”
Novartis declined ISMG’s request for additional details about the alleged incident.
Ransomware Trends
Sophos for its study contracted with research agency Vanson Bourne to conduct an independent, vendor-neutral survey of 5,600 IT professionals, including 381 healthcare respondents, in midsized organizations with 100 to 5,000 employees across 31 countries.
The survey, which was conducted during January and February 2022, found that when compared to all sectors surveyed, the rate of ransomware hits on healthcare was at par with the global average of 66 per cent.
The study defined being hit by ransomware as having one or more devices affected by an attack but not necessarily encrypted.
The survey also found that healthcare had the highest increase in the volume of cyberattacks – 69 per cent – as well as the complexity of cyberattacks – 67 per cent, compared to the cross-sector average of 57 per cent and 59 per cent, respectively. In terms of the impact of these cyberattacks, healthcare was the second-most-affected sector – at 59 per cent – compared to the global average of 53 per cent, the report says.
Healthcare was also the sector most likely to pay a ransom. But the average ransom – US$197,000 – was the lowest among all sectors, according to the Sophos study.
In terms of data encryption rates in ransomware attacks, healthcare had a 61 per cent encryption rate, lower than the global average of 65 per cent, indicating that healthcare fared slightly better in being able to stop data encryption in an attack, according to the Sophos survey.
Meanwhile, the percentage of healthcare sector victims who experienced extortion-only attacks, in which data was not encrypted but the organization was held to ransom with the threat of exposing data, fell to 4 per cent of ransomware attacks in 2022, from 7 per cent in 2020, the study says.
“One reason for this good showing could be that more healthcare organizations are now opting for cyber insurance, which demands higher cybersecurity defense enhancements,” the report says.
Principal research scientist at Sophos, Chet Wisniewski predicts, that given the increase in the ransomware-as-a-service model embraced by cybercriminals, combined with the “rich” personally identifiable information held by the healthcare sector, there will continue to be a high focus target for ransomware actors in the coming year.
“We’ve seen that adversaries have few scruples when it comes to who they target, and healthcare should expect to be targeted,” he says.
Emotet Warning
Meanwhile, HHS HC3 in its Emotet warning says that almost 80 per cent of the malware affecting computer systems in the healthcare industry is Trojans, and the most common of them is Emotet, according to researchers at security firm Malwarebytes.
Healthcare remains one of the top industries targeted by Emotet, which is often delivered via phishing but also by known vulnerabilities and brute force attacks, HC3 says.
Those incidents are often used to drop additional malware – such as Azorult, TrickBot, IcedID or Qbot – or ransomware, such as Ryuk and Bitpaymer, the advisory says.
“Emotet and TrickBot are two groups who very often work together in major cyberattack campaigns,” HC3 says.
