This article was originally written and posted on StaySafeOnline on June 7, 2019.
The healthcare industry is high on hackers’ hit lists due to the volumes of sensitive personal information ranging from Social Security numbers to financial information and everything in between.
Recently, both Quest Diagnostics and Laboratory Corporation of America Holdings (LabCorp) announced related data breaches that may impact up to 20 million customers who used their services between August 1, 2018 and March 30, 2019. Experts predict that we we will soon hear about many other companies and millions more consumers who may have been impacted.
While there are still some unknowns and details are being confirmed from third party medical vendor American Medical Collections Agency (AMCA), the compromised customer data is thought to have included personal, financial and medical patient data such as first and last name, date of birth, address, phone and credit card or bank account information.
“Healthcare companies have increasingly become a target for cybercriminals and other bad actors given the vast amounts of information that is collected and stored across the medical ecosystem. Businesses and organizations that accumulate data must operate with a deep understanding of the value of that data to cyber criminals and employ a comprehensive approach to cybersecurity, including robust vendor management strategies.” - Kelvin Coleman, Executive Director, National Cyber Security Alliance
eSentire recently commissioned a survey of IT and security decision-makers, which found that nearly half (44 percent) of firms had experienced a significant, business-altering data breach caused by a vendor.
The National Cyber Security Alliance (NCSA) recommends that employers and IT teams take the following steps to secure their business and work with third-parties and vendors to secure their customers’ data:
Identify your digital “crown jewels”: Crown jewels are the data without which your business would have difficulty operating and/or the information that could be a high-value target for cybercriminals. When assessing your vendor network, the IT team needs to map out not only who your vendors are, but who their vendors are who might have access to your data or systems. This includes working with your vendors to confirm the data they collect and whether or not they have formal and robust cybersecurity programs in place.
Protect your assets: Ultimately, your goal is to build a culture of cybersecurity that includes employees knowing how to protect themselves and the business and understanding the cyber risks as your business grows or adds new technologies or functions. When creating third-party contracts, include non-negotiable document data ownership and management processes, including how company data is handled, who owns the data and has access to it, how long the data is retained and what happens to data once a contract is terminated. Only people who need access to your data should have it. You should also have a lawyer look over any vendor agreements to ensure they take proper measures to protect data assets and grant appropriate access controls.
Be able to detect incidents: We have fire alarms in our businesses and homes that alert us to problems. In cybersecurity, the quicker you know about an incident, the quicker you can mitigate the impact and get back to normal operations. For vendor contracts, establish processes within your agreements that enable you to verify compliance with the negotiated terms. Third-party intelligence providers can also offer independent, unbiased inputs on the status of vendors. If a vendor is hit by a cyberattack, these third-party intelligence services will report back to you in a time-critical way.
Have a plan for responding: Having a recovery plan created before an attack occurs is critical. Develop and practice an incident response plan to contain an attack or incident and maintain business operations in the short term.
Quickly recover normal operations: The goal of recovery is to move from the immediate aftermath of a cyber incident to full restoration of normal systems and operations. Like the response step, recovery requires planning. Recovery is not just about fixing the causes and preventing the recurrence of a single incident. It’s about building out your cybersecurity posture across the whole organization (not just the IT person or group), including increasing the focus on planning for future events.
Attend a CyberSecure My Business™ Event: NCSA’s CyberSecure My Business holds events across the country and monthly webinars that shed light on how small and medium-sized businesses can protect themselves, their employees and their customers against the most prevalent threats. For more information on these events and locations, visit https://staysafeonline.org/cybersecure-business/
Major breaches like these remind Americans that it is critical for internet users to remain diligent about practicing good cybersecurity habits. NCSA recommends that consumers potentially impacted by the AMCA breach protect their accounts by following these steps to stay safer and more secure online, including:
Monitor activity on your financial and credit cards accounts. If appropriate, implement a fraud alert or credit freeze with one of the three credit bureaus (this is free and may be included if credit monitoring is provided post breach). For more information, visit the Federal Trade Commission website identitytheft.gov.
When in doubt, throw it out. Scammers and others have been known to use data breaches and other incidents to send out emails and posts related to the incident to lure people into providing their information. Delete any suspicious emails or posts and get information only from legitimate sources.