The healthcare industry has retained its spot as having the most expensive data breaches for the 13th consecutive year, according to a new report.
Research conducted by Ponemon Institute and sponsored by IBM Security found that the healthcare industry reported the most expensive data breaches across 17 different industries. The average healthcare industry data breach cost $10.93 million — a 53.3% increase over 2020 costs — compared with the average total cost of a breach in all industries of $4.45 million.
Critical infrastructure organizations — including healthcare, financial services, industrial, technology, energy, transportation, communication, education and public sector industries — incurred data breach costs that were 28.6% higher than the average cost to other industries.
Ransomware attacks accounted for 24% of malicious attacks overall. At $5.13 million, the average cost of ransomware attacks this year across all industries increased 13% from last year.
Among organizations that experienced a ransomware attack, those that had automated response playbooks or workflows designed specifically for such attacks were able to contain them in 68 days, 16% days fewer than organizations without those automatic playbooks and workflows. And organizations that paid the ransom during an attack only achieved a 2.2% cost savings compared with companies that did not pay the ransom.
“Given the high cost of most ransomware demands, organizations that paid the ransom likely ended up spending more overall than those that didn’t pay the ransom,” the report read.
Although data breach costs continued to increase, the 553 participant organizations interviewed for the study were split on whether they planned to increase security. Those who were planning to invest in security indicated that they planned to put their money into incident response planning and testing, employee threatening, and threat detection and response technologies.
The report provided several recommendations for organizations to reduce the financial and reputational impacts of a data breach, including:
- building security into every stage of software development and deployment,
- using data security and compliance technologies that work on all platforms,
- embedding security artificial intelligence and automation to increase speed and accuracy, and
- understanding potential exposure to attacks.
A January report from the Identity Theft Research Center similarly reported that the healthcare industry remains the top target of computer hackers. The center reported that 322 healthcare organizations suffered data breaches in 2022.
Senior living not immune to data breaches
Senior living and care operators have been a common target for hackers, with several data breaches reported in the past year:
- The operators of four not-for-profit senior living and care communities in Pennsylvania reported suspicious activity last month that affected some of their internal systems used for business operations. Senior Choice and The Williamsport Home both said unauthorized individuals may have accessed personal information about residents, providers and facilities.
- This spring, a vendor of clinical and third-party administrative services to managed care organizations serving elderly and disabled individuals disclosed a data breach affecting more than 4.2 million people. Independent Living Systems said the breach occurred in July 2022 and is facing a class action lawsuit.
- Medicalodges, a Kansas-based long-term care provider, was one of two companies targeted by the Karakurt Ransomware Extortion Group this spring. Last summer, the US Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center issued a warning that the Karakurt ransomware group was targeting healthcare organizations after four providers — including an assisted living provider — were targeted. A life plan community, Blakehurst, fell victim in December.
- Last fall, Lantern Hill, an Erickson Senior Living-managed continuing care retirement community in New Jersey, used a potential data breach of resident information as an opportunity to educate staff members and beef up its technical safeguards.
