Rural hospitals are facing escalating cyberthreats, with ransomware attacks putting patient lives and entire communities at risk. In part one of this conversation, John Riggi, national advisor for cybersecurity and risk at the American Hospital Association, and Justin Spelhaug, corporate vice president and global head of Tech for Social Impact at Microsoft Philanthropies, discuss the unique vulnerabilities rural hospitals face, the latest cyberthreats, and actionable strategies to strengthen defenses.
View Transcript
00:00:01:04 - 00:00:45:24
Tom Haederle
Health care tops the list of critical infrastructure targeted by cybercriminals. These threat to life crimes hit every hospital hard, but rural providers even harder due to fewer resources and generally smaller IT staff. The average recovery cost from a ransomware attack is $11 million, a vast sum that leaves many rural hospitals one cyberattack away from closure. In today's podcast, we hear from John Riggi, the American Hospital Association's national advisor for Cybersecurity and Risk, and Justin Spelhaug, corporate vice president of tech for Social Impact, Microsoft Philanthropies, about the steps rural providers can take to reduce the risk and impact of a ransomware attack.
00:00:45:27 - 00:01:13:18
Justin Spelhaug
I'm Justin Spelhaug the corporate vice president of tech for Social Impact here at Microsoft Philanthropies, and I'm joined by my co-host John Riggi, the national advisor for Cybersecurity and Risk at the American Hospital Association. And we're here today to discuss critical issues of cybersecurity in rural hospitals, and how our partnership is coming together to tackle the challenges that so many rural hospitals are facing across America.
00:01:13:19 - 00:01:17:09
Justin Spelhaug
So thank you for joining us. And John, thank you for joining us. Good to see you here today.
00:01:17:12 - 00:01:20:24
John Riggi
Good to see you too, Justin. It's always great to partner with you.
00:01:20:26 - 00:01:30:09
Justin Spelhaug
Well, John, you know, as the expert in hospital cybersecurity, can you tell us why rural hospitals are particularly vulnerable to cyber attacks?
00:01:30:11 - 00:01:58:19
John Riggi
Justin, great question. There's really a number of factors about that. First, the impact of the physical distance on patient care and mortality when a hospital is shut down by a ransomware attack. For example, rural hospitals provide critical health services to about 60 million Americans, or nearly 20% of the US population. Rural residents already must travel more than twice as far as urban residents to reach the nearest hospital.
00:01:58:22 - 00:02:30:22
John Riggi
So when you have this increased travel distances, they are directly associated with higher mortality rates for time sensitive conditions like heart attack, stroke or trauma. And then you're diverting these patients during a ransomware attack, again just magnifying that risk. Then there are the resource challenges, financial constraints and skill shortages. Low operating margins due to patient volumes, high fixed costs relative to urban hospitals. And rural hospitals are more likely to have older technology and smaller IT support staff.
00:02:30:27 - 00:02:59:06
John Riggi
This impacts the resources to implement key cybersecurity measures, creating really, unfortunately, an ideal opportunity for exploitation for cyber criminals. The average cost of addressing cyber attacks - now this is the cost after you've been attacked - the cost to recover is almost $11 million. I mean, just an enormous, staggering amount for the average rural hospital. Thirty percent of all rural hospitals are already at risk of closing,
00:02:59:08 - 00:03:22:09
John Riggi
so they can be only one cyber attack away from closure. And then, of course, as I indicated, there's a skill shortage. Very difficult to get your best cyber security professionals to work in rural areas. The salaries are generally not as competitive as urban areas or even other industries, so you compile that...it's extremely challenging to get good experienced
00:03:22:10 - 00:03:53:22
John Riggi
IT staff to work in rural America. And then we have geopolitical factors making rural hospitals kind of unique targets. So over the past 12 months, cyber attacks against hospitals have increased about 130%, making them the top critical infrastructure that's targeted by cybercriminals. And make no mistake, they know when they target a hospital, lives are threatened. In fact there's now even evidence that nation-states are collaborating with criminal groups.
00:03:53:24 - 00:04:04:21
John Riggi
Justin, I know Microsoft keeps a very close eye on the evolving threat landscape. Can you talk to us a bit about the trends you're watching that might affect health care organizations?
00:04:04:24 - 00:04:27:13
Justin Spelhaug
I can and John, thanks. I mean, your feedback that hospitals are only, you know, one cyberattack away from closing, especially the rural hospitals that are very stretched, is just really eye opening. And when we look at the challenge facing hospitals, but frankly, many different kinds of organizations, one of the reports that we produced is a Microsoft Digital Defense report.
00:04:27:18 - 00:04:51:13
Justin Spelhaug
Now, we use about 78 trillion security signals a day from Windows and Cloud endpoint devices to inform this report. We've got security engineers and intelligence analysts tracking about 1500 unique threat groups all around the world. And the trends I'll talk about here are relevant for every industry. But as you said, John, it's impacting health care and it's impacting rural health care in particular.
00:04:51:17 - 00:05:32:03
Justin Spelhaug
So let's talk about a couple of the trends. The first one is that we're continuing to see a massive escalating intensity on password based attacks. When we look at our Microsoft entry data, we see organizations being barraged by about 600 million identity attacks per day, and 99% of those are password based. Now, advances such as zero trust architecture, conditional access policy, MFA have helped defend against this. But we're seeing hackers work around MFA, targeting infrastructure and applications and bypassing authentication altogether.
00:05:32:03 - 00:05:59:15
Justin Spelhaug
And that's why advanced monitoring and threat detection capabilities inside of an environment are so critical. So that's the first theme. The second theme that we see is nearly a 3X increase in year-over-year human operated ransomware attacks. They're attacking health care. They're attacking rural hospitals. They're attacking nonprofit. They're attacking schools, they're attacking sensitive government infrastructure. Now, on the good news
00:05:59:15 - 00:06:27:25
Justin Spelhaug
if there is any good news anywhere in this story, is we see a significant decline year-over-year in attacks reaching the encryption stage and locking up resources. And that's because of the deployment of automated attack disruption tool. It is also endpoint protection deployment 92%, 92% of all successful ransomware attacks involve the attacker going through unmanaged device on the network.
00:06:27:27 - 00:06:50:08
Justin Spelhaug
And it's also about increased training and awareness across the employee base in every organization. But we need to keep making progress because as you know, John, you said the average recovery was about an $11 million investment when they break through. It's devastating, for a rural hospital in particular it's devastating. We're also seeing a third theme and that's the ingenuity of fraud
00:06:50:08 - 00:07:20:26
Justin Spelhaug
tactics are quickly evolving. We saw growing sophistication of investment scams, tech support scams are particularly impacting hospitals and more. At the same time, we're seeing impersonation getting more sophisticated, in fact, and detection more difficult because of the access to deepfake technologies that cybercriminals are using. And globally, the World Economic Forum reports that scammers stole over 1 trillion in U.S. dollars from the global economy in 2023.
00:07:20:26 - 00:07:54:11
Justin Spelhaug
So the massive, massive impact. Then finally, John, something that you mentioned, nation-states. We're seeing actually blurred lines between nation-state threat actors and cybercriminals. They're partnering together to advance each other's objectives and in particular monitoring and see Iran, who appears to be the most active nation-state actor targeting health care organizations specifically. Perhaps the most acute impacts and the biggest headlines have been in the health sector, certainly over the last 12 months.
00:07:54:13 - 00:08:13:15
Justin Spelhaug
And when you talk about a small rural organization or a rural hospital, John, as you just did with less resources as you just talked about to protect themselves and respond. We know why, you know, hackers are targeting these organizations and why it is such a huge challenge for us here in the United States. So big challenges all around.
00:08:13:17 - 00:08:25:04
Justin Spelhaug
Now, John, those are the challenges. Can you talk a little bit about the impacts you're seeing these cyber attacks actually have on hospitals and maybe even more importantly, the communities that they serve?
00:08:25:06 - 00:08:56:17
John Riggi
As you know, the AHA has been a very loud voice signaling what the impact is of these ransomware attacks on hospitals. Unfortunately, this isn't just about the protection and privacy of data. It's very important, but most importantly is the disruption to patient care. These attacks have caused significant disruption and delay to health care delivery when hospitals are attacked directly or through some third party attack that results in a disruptive effect.
00:08:56:24 - 00:09:31:09
John Riggi
And we all know that when there is disruption and delay to health care delivery, patient safety is placed at risk. Lives are threatened. The bottom line: these attacks are not just data theft crimes. These are threat to life crimes. And again, they're not only going after hospitals, but after our mission critical third party providers. For instance, the Change Healthcare attack: the largest, most consequential cyberattack against health care in history, compromised the health care records of 100 million patients, 100 million Americans, costing the sector $100 million a day.
00:09:31:12 - 00:09:57:23
John Riggi
And then ultimately disrupting health care delivery. But it's not just the big organizations that are attacked. And of course, when a rural hospital is attacked, there's an outsized impact to the community they serve. Because these attacks, as we have seen, are not just attacks on the hospital as an organization. It's an attack against the patients inside the hospital and against the entire community
00:09:57:23 - 00:10:26:11
John Riggi
that depends on the availability of that hospital. A couple of years ago, we had an attack on Sky Lakes Medical Center in southern Oregon. Their 90 bed hospital serve about 120,000 people across 10,000 square miles. Their next nearest hospital, 72 miles away. And when this attack occurred and encrypted their systems forcing them to shut down many of their services, it was very, very significant disruption.
00:10:26:11 - 00:10:54:01
John Riggi
And that disruption lasted about 28 days. They had to use 60,000 sheets of paper for clinical documentation. Fortunately, they did not have to pay the ransom. They had the capability to recover and restore independently. But again, significant impact to patient care delivery. And even after it hired extra staff, it took some six months to input all the paper records into the system.
00:10:54:03 - 00:11:23:00
John Riggi
So the organization spent about $10 million, a huge expense that was not covered by insurance to overcome this attack. And we have to thank Skylights Medical Center for coming forward to share best practices and lessons learned so we can all help prepare for the impact of these attacks. Unfortunately, I have many examples of how these attacks affect the patients in these rural hospitals, but also threaten the safety of the entire community.
00:11:23:03 - 00:11:45:10
John Riggi
A couple years back, I got a call from a hospital in the Pacific Northwest, and they were talking about an attack that they were experiencing, but there were two other hospitals that were also under attack. And so their natural diversion points no longer existed. And they said, John, we are very, very concerned because our next nearest emergency department is 125 miles away.
00:11:45:16 - 00:12:02:21
John Riggi
Said John, we've got a medevac parked in the parking lot, but we already are in the state. It actually snows in the winter quite a bit, and we're expecting a storm to come in. If that happens, our medevac can't fly. And if we get a stroke, heart attack or trauma patient, that patient's going to have to go ground transport if it's even safe.
00:12:02:23 - 00:12:21:20
John Riggi
And unfortunately, we don't think that patient would make it under those conditions. That's how deadly serious these attacks are. And that's why we always say and tell the federal government that these attacks - make no mistake - the bad guys know what they're doing in the hospital. They're threatening lives. These are threat to life crimes.
00:12:21:22 - 00:12:39:29
Tom Haederle
Thanks for listening to part one of this podcast. Please join us on Wednesday for part two as we continue this important conversation on cybersecurity for rural hospitals. Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcast.