Among these attacks, 44.4% of attacks, or 166, disrupted the delivery of healthcare. The most common causes of disruption included electronic system downtime (41.7%), cancellations of scheduled care (10.2%) and ambulance diversion (4.3%). Just 32 attacks were associated with a disruption exceeding two weeks.

Across all the 374 reported attacks in the study, 1 in 5 were able to restore data from backups. Unfortunately, for 59 of the attacks, there is evidence stolen PHI was made public, such as on dark web forums “where stolen data are advertised for sale by including a subset of records,” wrote first author Hannah T. Neprash, PhD, of the University of Minnesota, School of Public Health, et al. 

“The growing number of attacks affecting large entities (those with multiple facilities) and the associated growth in PHI exposed (along with the diminishing likelihood that an organization could restore data from backups) suggest that ransomware attacks on healthcare delivery organizations have increased in sophistication as well as in frequency,” Neprash et al. wrote.

The findings support other observations that healthcare entities are increasingly targets for ransomware attacks, due in part to the high-value of the PHI they typically store. Researchers noted the number of attacks is likely underreported, potentially due to low PHI exposure, such as those affecting fewer than 500 individuals. 

In addition, researchers noted that, over time, more healthcare organizations are reporting ransomware attacks outside of the 60-day reporting period. Part of the issue may be that there are no sanctions for reporting attacks late. When PHI is exposed, the fallout can be very detrimental to healthcare organizations. Patients may no longer trust that healthcare organization, and the cost of an individual data breach has risen to $10 million on average, according to another recent study. Researchers noted that increasing budgets to protect PHI and thwart ransomware attacks may be necessary.