Health-ISAC's Response to the Change Healthcare Breach: Healthcare Cybersecurity Lessons for Vendors

On 21st Feb 2024, Change Healthcare suffered a ransomware attack. This cyberattack was orchestrated by ALPHV/BlackCat.

In order to contain the threat, Change Healthcare disconnected more than 111 services from its network. To reduce and eliminate the danger of ransomware, the organization also collaborated with cybersecurity and law enforcement organizations.

Approximately 800,000 doctors, 117,000 dentists, 60,000 pharmacists, 5,500 hospitals, and almost all government and private players were impacted by this attack.

This article examines Health-ISAC's swift and effective response to the Change Healthcare breach and provides important healthcare cybersecurity lessons for vendors.

What is Change Healthcare?

Change Healthcare is a healthcare technology provider, which provides solutions related to healthcare such as health information exchange (HIE), payment administration, and revenue cycle management.

What is Health- ISAC?

Health- ISAC is a non-profit organization that promotes cooperation and information exchange about cyber dangers within the healthcare sector. Hospitals, clinics, health insurance, and cybersecurity companies can exchange best practices, incident response guidelines, and real-time threat intelligence with each other using this platform.

Health-ISACS’s response to the Change Healthcare Breach:

Following the ransomware attack, Health-ISAC played a critical role in mitigating and curbing the potential dangers of the cyber attack.

Here’s what Health-ISAC did:

Information Sharing:

Health-ISAC created a secure chat channel in a matter of hours in response to the Change Healthcare breach. More than 700 cybersecurity experts were able to exchange ideas and create reaction plans at this virtual meeting. By providing notifications with incident data, resource links, and advice on network connections with Change Healthcare's parent business, UnitedHealth Group, Health-ISAC was able to provide further help to its members.

Guidance:

Health-ISAC made use of its expertise to offer organizations helpful advice on how to handle the incident. This includes suggestions for keeping an eye out for indications of intrusion in system logs, putting containment measures in place to stop more harm, and notifying the proper authorities of the situation. Health-ISAC also provided best practices for enhancing overall cybersecurity posture, including frequent vulnerability assessments, timely system patches, and educating users about cyber threats

Further Collaboration:

Health-ISAC saw the need for an all-encompassing approach that went beyond just healthcare. To exchange threat intelligence and coordinate investigation efforts, they actively cooperated with government organizations such as the Department of Health and Human Services (HHS) and the Cybersecurity and Infrastructure Security Agency (CISA). This cooperative strategy guaranteed a quick and effective response to the ransomware attack.

Healthcare Cybersecurity Lessons for Vendors: Responding to Cyberattacks in the Healthcare Sector

Here are key healthcare cybersecurity lessons for vendors, aimed at helping them create more robust solutions to withstand cyber attacks.

Despite the healthcare industry's many cybersecurity defenses, a new ransomware attack serves as a reminder that weaknesses can be exploited at any time and provides crucial healthcare cybersecurity lessons for vendors. Therefore, cybersecurity vendors should always have systems set in place to respond to a cyberattack.

Cybersecurity vendors providing services to the healthcare sector or hoping to, can gain a lot of insight from Healthcare-ISAC's response. Here are some steps you can take to strengthen your services and know how to react in the event of a cyberattack, particularly a ransomware attack:

Develop Threat Intelligence Sharing Systems:

Like Health-ISAC, cybersecurity vendors should also prioritize the development of threat intelligence-sharing platforms specifically designed to act in the instance of a cybersecurity breach. These platforms should enable real-time information exchange about emerging threats, attacks, and vulnerabilities.

Invest in Advanced Cybersecurity:

Cybersecurity vendors should make an effort to provide cutting-edge products that are specifically suited for the healthcare sector. In order to recognize unusual behavior, find malware, and stop breaches before they happen, these technologies ought to make use of machine learning and artificial intelligence (AI) and best cybersecurity practices.

Providing Cybersecurity Education:

The human element remains a critical factor in cybersecurity. Vendors should provide user education programs that raise awareness about cyber threats and best practices for secure online behavior.

Here’s how insider threats can lead to a cybersecurity breach:

Phishing:

Phishing can masquerade as everyday emails. These deceptive messages, often appearing legitimate, can trick you into clicking malicious links or opening infected attachments. These actions could unleash ransomware or other threats on the company's system.

Negligence:

Insider negligence poses a serious security risk. Employees who disregard security policies, like tailgating someone into restricted areas, losing sensitive devices, or ignoring critical software updates, expose the organization to potential data breaches and other cyberattacks.

The Change Healthcare breach was a reminder of the many cybersecurity issues that the healthcare sector faces. But it also demonstrated the important role that Health-ISAC performed. This incident offers valuable healthcare cybersecurity lessons for vendors. Cybersecurity vendors need to take note of this incident and adjust their services as well as develop an action plan in case of a breach.

Looking to Sell Cybersecurity Services to The Healthcare Sector?

Platforms such as Execweb, focus on facilitating the connection between cybersecurity vendors and healthcare decision-makers at the director and CISO levels. Their approach involves personalized introductions that demonstrate a clear understanding of the specific needs of healthcare organizations regarding cybersecurity.

For cybersecurity vendors looking to overcome lead generation barriers, speed sales cycles, and engage with key stakeholders in the healthcare sector, work with Execweb now to ease the process of selling cybersecurity services to healthcare.