[00:00.0 - 00:02.5] In the past two years, a troubling number [00:02.5 - 00:05.3] of ransomware attacks on healthcare organizations [00:05.3 - 00:08.5] have affected more than 6.6 million people [00:08.5 - 00:11.3] and cost systems millions of dollars. [00:11.3 - 00:14.6] A study by Comparatech found Texas had the second most number [00:14.6 - 00:18.9] of healthcare ransomware attacks in 2016-2019. [00:18.9 - 00:20.5] During a ransomware attack, [00:20.5 - 00:23.1] hackers break into an electronic database [00:23.1 - 00:25.2] and hold the information hostage [00:25.2 - 00:27.2] until an amount of money is paid.
[00:27.2 - 00:29.0] The U.S. Department of Health Services [00:29.0 - 00:32.1] publishes breaches that affect more than 500 people. [00:32.1 - 00:34.3] However, Comparatech found many other breaches [00:34.3 - 00:35.6] fall under the radar, [00:35.6 - 00:37.6] but still have the possibility [00:37.6 - 00:40.0] of causing disruptions in service.
[00:40.0 - 00:41.1] The study team went through [00:41.1 - 00:43.3] several different healthcare resources [00:43.3 - 00:46.8] and found Texas had 14 such ransomware incidents [00:46.8 - 00:49.9] that affected 483,300 people [00:49.9 - 00:53.7] and causing downtime costs of approximately $12.8 million, [00:54.6 - 00:56.6] 18.6 million. [00:56.6 - 00:58.0] Across the United States, [00:58.0 - 01:01.4] the study found 172 ransomware attacks [01:01.4 - 01:05.0] that affected 1,346 hospitals, [01:05.0 - 01:07.9] clinics, and other organizations. [01:07.9 - 01:09.6] About three-fourths of the attacks [01:09.6 - 01:11.4] were on hospitals or clinics.
[01:11.4 - 01:12.9] The amount of ransom demanded [01:12.9 - 01:17.2] ranged between $1,600 and 14 million. [01:17.2 - 01:18.4] While hackers have demanded [01:18.4 - 01:22.1] more than 16 million in ransoms since 2016, [01:22.1 - 01:26.0] only about 640,000 has been paid to hackers. [01:26.0 - 01:28.8] The total cost of these attacks across the country [01:28.8 - 01:32.6] is estimated to be about 157 million.
[01:32.6 - 01:35.9] California had the most ransomware attacks since 2016 [01:35.9 - 01:37.8] at 25 incidents. [01:37.8 - 01:40.8] Texas had the second most attacks at 14. [01:40.8 - 01:43.9] Looking at the number of people affected by such attacks, [01:43.9 - 01:46.5] Michigan had the most patient records at risk [01:46.5 - 01:49.9] at 1.1 million people during two attacks.
[01:49.9 - 01:53.0] As a percentage of the state's population affected, [01:53.0 - 01:56.6] Texas ranked rather low at just 1.67% [01:56.6 - 01:59.8] of the population affected by a ransomware attack. [01:59.8 - 02:00.9] The states and territory [02:00.9 - 02:03.7] with the highest percentage of the population affected [02:03.7 - 02:06.0] was Michigan, 11%, [02:06.0 - 02:08.8] Puerto Rico, 16.36%, [02:08.8 - 02:11.1] Delaware, 9.87%, [02:11.1 - 02:13.7] and Utah, 98%. [02:13.7 - 02:16.6] Rather than seeing a steady increase or decrease, [02:16.6 - 02:19.1] the number of cyber crimes against healthcare systems [02:19.1 - 02:21.8] seems to rise and fall in these four years.
[02:21.8 - 02:25.2] In 2016, there were 36 ransomware attacks, [02:25.2 - 02:28.6] 53 in 2017, 31 in 2018, [02:28.6 - 02:31.6] and then rising again to 50 in 2019. [02:31.6 - 02:33.4] The difference could be the development [02:33.4 - 02:35.8] of different types of ransomware used. [02:35.8 - 02:36.8] In the United States, [02:36.8 - 02:38.7] cybersecurity is often left up [02:38.7 - 02:40.7] to the individual organizations.
[02:40.7 - 02:43.6] These kinds of attacks do not seem to be going away, [02:43.6 - 02:45.6] which could place pressure on organizations [02:45.6 - 02:48.6] to install more measures to secure patients' data [02:48.6 - 02:51.9] and avoid potential lawsuits due to such breaches. [02:51.9 - 02:54.8] Out of the 172 attacks nationwide, [02:54.8 - 02:56.9] the amount of money demanded by hackers [02:56.9 - 02:59.9] was only revealed in 16 of the cases. [02:59.9 - 03:04.9] Of the 16.48 million demanded by hackers in these cases, [03:04.9 - 03:06.6] 14 million was demanded [03:06.6 - 03:10.5] of one Wisconsin-based information technology provider, [03:10.5 - 03:12.9] Virtual Care Provider, Inc.
[03:12.9 - 03:16.3] This attack affected 11 nursing homes across the country, [03:16.3 - 03:18.7] but the ransom was not paid. [03:18.7 - 03:20.0] Out of all the attacks, [03:20.0 - 03:23.0] 21 organizations said they paid the ransom, [03:23.0 - 03:26.0] but only seven revealed how much they paid. [03:26.0 - 03:30.2] In 66 attacks, the organization said they did not pay, [03:30.2 - 03:31.6] and in 85 cases, [03:31.6 - 03:34.9] it was unclear if the ransom was paid or not.
[03:34.9 - 03:38.1] The amount of downtime a ransomware attacks causes [03:38.1 - 03:40.5] can range from a few hours to weeks, [03:40.5 - 03:42.8] even causing some healthcare organizations [03:42.8 - 03:44.4] to close permanently. [03:44.4 - 03:45.8] In at least two cases, [03:46.2 - 03:47.8] healthcare providers permanently closed [03:47.8 - 03:50.0] because of ransomware attacks. [03:50.0 - 03:53.1] The average downtime because of a ransomware attack [03:53.1 - 03:55.4] is just over 16 days.
[03:55.4 - 03:57.1] The heavy cost of ransomware attacks [03:57.1 - 03:59.3] is just over $1,000 a month. [03:56.3 - 03:59.9] ransomware attacks is not just in the ransoms paid, [03:59.9 - 04:04.3] but also in recovering data when the ransom is not paid. [04:04.3 - 04:06.0] Erie County Medical Center in New York [04:06.0 - 04:08.4] did not pay a $30,000 ransom, [04:08.4 - 04:10.3] but then spent nearly 10 million recovering [04:10.3 - 04:12.6] from an April 2017 attack.
[04:12.6 - 04:16.3] NEO Urology in Ohio was attacked in June 2019 [04:16.3 - 04:18.8] and paid a $75,000 ransom, [04:18.8 - 04:23.8] but suffered losses of $30,000 to $50,000 per day. [04:23.8 - 04:25.5] Hospitals and other health providers [04:25.5 - 04:28.5] are often seen as easy targets to hackers, [04:28.5 - 04:30.6] and the concern continues to grow [04:30.6 - 04:32.6] about these kinds of attacks. [04:32.6 - 04:35.2] As technology continues to develop, [04:35.2 - 04:38.0] cybersecurity efforts need to keep pace.
[04:38.0 - 04:40.5] Without the right safety measures in place, [04:40.5 - 04:43.1] hospitals may soon be facing ransomware attacks [04:43.1 - 04:45.9] on life-saving equipment and technology, [04:45.9 - 04:48.7] as well as crucial patient data and systems, [04:48.7 - 04:50.2] the study reports. [04:50.2 - 04:52.4] Texas healthcare organizations affected [04:52.4 - 04:54.9] by ransomware attacks in the past 24 months, [04:54.9 - 04:58.7] according to U.S. Department of Health and Human Services, [04:58.7 - 05:03.7] MHMR, Tarrant County, Fondren Orthopaedic Group, LLP, [05:04.0 - 05:05.7] Lifeline Screening of America, [05:09.1 - 05:11.8] Baylor-Maraca Genetics Laboratories, [05:11.8 - 05:15.9] LLC DBA, Baylor Genetics Petty Health, [05:15.9 - 05:18.4] PLC DBA Children's Choice Pediatrics, [05:18.4 - 05:22.0] Texas Family Psychology Associates, PC, [05:22.0 - 05:24.1] Texas Children's Hospital, [05:24.1 - 05:26.3] River Kids Pediatric Home Health, [05:26.3 - 05:29.8] Choice Cancer Care Outreach, Health Service, [05:29.8 - 05:32.7] Evergreen, Psychological Services, [05:32.7 - 05:36.1] Corpus Christi, Tots and Teens Pediatrics, [05:36.1 - 05:39.9] Texas Health, Harris, Methodist Hospital, [05:39.9 - 05:42.8] Hearst-Uless, Bedford-Texas Health, [05:42.8 - 05:45.6] Presbyterian Hospital, Dallas, [05:45.6 - 05:49.2] Texas Health-Harris, Methodist Hospital Alliance, [05:49.2 - 05:52.1] Texas Health-Presbyterian Hospital, [05:52.1 - 05:56.0] Denton, Texas Health-Harris, Methodist Hospital, [05:56.0 - 06:00.3] Azell, Texas Health-Harris, Methodist Hospital, [06:00.3 - 06:04.1] Cleburne, Texas Health-Harris, Methodist Hospital, [06:04.1 - 06:08.5] Southwest Fort Worth, Texas Health-Presbyterian Hospital, [06:08.5 - 06:11.8] Rockwall, Texas, Health-Harris, Methodist Hospital, [06:11.8 - 06:14.2] Stevenville, Texas, Health-Harris, Methodist, [06:14.2 - 06:17.3] Southlake, Texas, Howell-Arlington Memorial, [06:17.3 - 06:19.8] Texas Health-Presbyterian Hospital, [06:19.8 - 06:23.0] Plano, Texas, Health-Harris, Methodist Hospital, [06:23.0 - 06:26.0] Kauffman, Texas Health-Harris, Methodist Hospital, [06:26.0 - 06:29.3] Fort Worth, Texas Health-Presbyterian Hospital, [06:29.3 - 06:32.7] Allen, South Texas, Dermatopathology Laboratory, [06:32.7 - 06:35.1] Berry Family Services, Wilson County, [06:35.1 - 06:37.7] Memorial Hospital, District, DBA, [06:37.7 - 06:39.4] Connelly Memorial Medical Center, [06:39.4 - 06:44.1] Primary Medicine of Sherman, PA slash Robert J.
Hernandez, [06:44.1 - 06:46.9] MD Community Health Choice, Inc., [06:46.9 - 06:49.9] Clinical Pathology Laboratories, Inc., [06:49.9 - 06:53.2] Wise Health System, Hunt Regional Medical Center, [06:53.2 - 06:57.3] Memorial Hermann Health System, Informed Diagnostics, Inc., [06:57.3 - 06:59.6] City of Georgetown Fire Department, [06:59.6 - 07:03.6] SurpassRx, LLC, Sunshine Family Dentistry, [07:03.6 - 07:06.3] Special Health Resources for Texas, Inc., [07:06.3 - 07:09.9] Memorial Hermann Health System, University Medical Center, [07:09.9 - 07:12.4] Physicians Kelsey Research Foundation, [07:12.4 - 07:15.6] Mid-Cities Home, Medical Delivery Service, [07:15.6 - 07:18.2] LLC, Quest Care Medical Services, [07:18.2 - 07:22.4] PLLC, Weslaco Regional Rehabilitation Hospital, [07:22.4 - 07:25.3] MetroCare Services, Rainbow Dental Care, [07:25.3 - 07:28.2] PLLC, Texas VSI, [07:28.2 - 07:31.9] LLC, Oprex Surgery, Baytown, [07:31.9 - 07:35.9] LPDBA, Altus Baytown Hospital, [07:35.9 - 07:39.2] Dallas County Mental Health Mental Retardation Center, [07:39.2 - 07:43.2] DBA, MetroCare Services, First Care Health Plans, [07:43.2 - 07:47.4] Dr. Robert Carpenter, Amy Woodruff, J&J, [07:47.4 - 07:49.6] Medical Service Network, Inc., [07:49.6 - 07:52.6] the University of Texas Health Science Center at Houston.
