Healthcare Earns a ‘B+’ on Cybersecurity in First Half of 2024

Despite earning a passing grade in cybersecurity for the year’s first half, the healthcare industry still faces a significant threat to its supply chain, according to new SecurityScorecard threat research.

SecurityScorecard’s new report, “The Cyber Risk Landscape of the U.S. Healthcare Industry, 2024,” examines historical breach data and security ratings to provide insights for healthcare organizations to stop supply chain breaches.

In the wake of the Change Healthcare ransomware attacks, SecurityScorecard STRIKE threat analysts investigated the most critical risks faced by the 500 largest U.S. healthcare companies.

Key findings:

• Healthcare industry earns a B+: The U.S. healthcare sector’s security ratings were better than expected, with an average score of 88. However, there is still room for improvement: Organizations with a B rating are 2.9x more likely to be victims of data breaches than those with an A rating.
• Healthcare industry leads in third-party breaches: Thirty-five percent of third-party breaches in 2023 affected healthcare organizations, outpacing every other sector. The supplier ecosystem is a highly desirable target for ransomware groups. Attackers can infiltrate hundreds of organizations through a single vulnerability without being detected.
• Medical device organizations have a higher risk of compromise: Medical device and equipment companies scored two to three points lower than those of the overall healthcare sample. These organizations also had a 16% higher rate of reported breaches and compromised machines than those in other healthcare sectors.
• AppSec is the biggest attack surface threat: Application security issues are among the most significant flaws in healthcare attack surfaces—48% of organizations scoring the lowest in this category. The software supply chain gives an attacker access to source code, build processes, pipeline tools, or software updates to carry the attack downstream to the supplier’s customers, which often implicitly trust the vendor and its systems.
• Breaches remain low despite rising threats: Five percent of healthcare organizations experienced publicly reported breaches in the past year, and 6% had evidence of a compromised machine on their networks in the past 30 days. Ransomware remains a top threat to the industry, as reflected in the public reporting on these attacks.

As a result of Change Healthcare costing some companies $1 million daily, corporate security executives are doubling down on efforts to bolster supplier oversight and cybersecurity measures. Every organization must scrutinize its data security practices, assess third- and fourth-party access to sensitive data, and identify critical vendors essential to revenue, SecurityScorecard warns.

“One single point of failure, like Change Healthcare which underpinned medical claims processing, can cripple the entire healthcare ecosystem. And history will continue to repeat itself if the cybersecurity community does not actively monitor supply chain risk. Together, we must identify and address single points of failure,” said Ryan Sherstobitoff, senior vice president of Threat Research and Intelligence at SecurityScorecard.

The STRIKE threat intelligence team combines unique threat intelligence, incident response experience, and supply chain cyber risk expertise. Backed by SecurityScorecard technology, STRIKE is a strategic advisor to CISOs worldwide, empowering the entire digital ecosystem to identify, measure, and resolve cyber risk.

Funded by investors, including Evolution Equity Partners, Silver Lake Partners, Sequoia Capital, GV, Riverwood Capital, and others, SecurityScorecard provides cybersecurity ratings, response, and resilience, with more than 12 million companies continuously rated. Founded in 2014 by security and risk experts Dr. Aleksandr Yampolskiy and Sam Kassoumeh, SecurityScorecard’s patented security ratings technology is used by more than 25,000 organizations for enterprise risk management, third-party risk management, board reporting, due diligence, cyber insurance underwriting, and regulatory oversight. SecurityScorecard helps transform the way companies understand, improve, and communicate cybersecurity risks to their boards, employees, and vendors. SecurityScorecard achieved the Federal Risk and Authorization Management Program (FedRAMP) Ready designation, highlighting the company’s robust security standards to protect customer information, and is listed as a free cyber tool and service by the U.S. Cybersecurity & Infrastructure Security Agency.