At least 78% of global healthcare organisations experienced at least one cybersecurity incident in the last year, according to a new survey from Claroty.

The study interviewed 1,100 cybersecurity professionals from healthcare organisations across Europe, North America, South America, and Asia, who divulged the effects of cyber incidents on healthcare institutions.

Of those that suffered a incident, 61% said the event had a moderate or substantial impact on care delivery, with a further 15% globally reporting a severe impact on patient health and safety.

In around 30% of global incidents, only IT systems were affected, but in another 30% of instances, medical devices, like MRIs or infusion pumps, were affected by a cyber incident, potentially putting patient care at greater risk.

27% of global incidents affected BMS devices, like elevators, ventilation controllers, or security cameras, increasing infrastructure risks and potentially delaying life-saving care.

Sensitive data like personal health insurance information was also affected in 30% of cases, potentially opening up patients and staff at greater cyber-risks.

Cybersecurity leaders in healthcare organisations across Europe are typically most concerned about ransomware (43%) insider threats (43%), supply chain attacks (41%), and Denial of service (DoS) attacks (41%).

Concerningly, as digital transformation efforts increase the number of connected devices, medical devices are put at greater risk of cyber threats if they are not secured properly.

On a global basis, the report found that 38% of organisations are at or below a basic level of network segmentation, creating potential exposure to risk.

Just over half (57%) of organisations in Europe said they had highly or moderately proactive vulnerability management strategy for medical devices. 5% said they had none in place, and 12% adopted a reactive approach.

However, it appears cybersecurity is becoming a priority among healthcare organisations, and 54% of European organisations reported that their security budget has increased in the past year. This matches the concern among European raking of “lack of overall budget” as a top gap in their threat preparedness.

A majority of European organisations (58%) did say that their security posture had improved in the past year, with only 18% reporting that it had declined, and 23% reporting no change.

Recommended

• Report: 79% of UK Healthcare Providers Cyber-attacked in Last 2 Years
• Scots Expect IoT to Enhance Healthcare in Scotland
• Scottish Universities Share £20m Funding to Transform Healthcare

Looking to the future, European respondents said they would most like their organisations to focus on identifying vulnerabilities (22%), training employees (18%), and monitoring network traffic and device behaviour (16%) to improve their cybersecurity.

Further, 78% say that their biggest gap in defenses currently is patching vulnerabilities in medical devices.

“The healthcare industry has a lot working against it on the cybersecurity front—a rapidly expanding attack surface, outdated legacy technology, budget constraints and a global cyber talent shortage,” said Yaniv Vardi, CEO of Claroty, in a blog post.

“Our research shows that healthcare delivery organizations need the full support of the cyber industry and regulatory bodies in order to defend medical devices from mounting threats and protect patient safety.”