- On the underground market, stolen health records can cost as much as $300 each, while stolen financial and credit card numbers usually sell for much less.
- Healthcare organisations are top targets for cyber attackers, and this could continue to drive the demand for cyber intelligence solutions.
- Health data gives attackers more opportunities for long-term exploitation and different means to make money, making healthcare companies more prone to recurring attacks than one-time breaches.
Your medical history is worth more to hackers than your credit card number. That’s not an opinion. It’s a finding from fresh security research.
A recent blog post from Flare pulled back the curtain on underground pricing. The numbers tell a clear story about criminal priorities.
What the Research Found
Flare’s internal security research looked at 348 price points for personally identifiable information. The team examined these listings across dark web markets. Their discovery turned heads.
Stolen health records command roughly $300 per record. That is real money in the cybercrime world. Now compare that to bank account numbers. Or stolen credit cards. Both sell for much lower amounts on these same underground markets.
The difference matters. It shows what cybercriminals truly value. And right now, they value your medical data most.
Why Health Data Fetches Top Dollar
Hackers don’t just steal health records and sell them for cash quickly. They also think ahead about using the data over time.
According to an analysis by Flare, health data has much longer exploitation cycles than other data. Credit cards can be canceled almost immediately, and bank accounts can be locked within hours.
However, medical records are somewhat permanent and have very sensitive information in them – name, date of birth, social security number, and usually complete information about your health.
If criminals obtain access to your medical records, they have the means to commit crimes for a long time. Some examples of how they can use your medical records to commit crimes are by filing false claims with your insurance company, buying medical supplies for illegal resale, and using your medical information as a tool in an extortion scheme against you.
The several ways to generate money from health data are why health data is highly valued by criminals. Flare’s article points out that there is an abundance of monetization avenues, which adds to the total value of the medical record.
The Implications
There are several implications for this research in terms of how we will need to consider healthcare cybersecurity going forward. A few of them are:
The financial incentive for attacking healthcare providers has become clearer. Hackers see hospitals/clinics as a source of income, and not simply a means of extracting money through ransomware, but rather due to the data contained within their systems.
A recent case demonstrates the lengths hospitals must go to protect patient data. A UK hospital sued a ransomware gang to prevent the sale of stolen patient information on the dark web, showing how healthcare organizations are fighting back.
The threat landscape within healthcare organizations is more diverse than that of the majority of industries face. In addition to defending against ransomware, you’ll also have to defend against data theft, identity theft rings, and the long-term exploitation of patients.
For investors, this signals the continued expansion of an entire new growing market. There are acute and financially motivated cybersecurity risks in relation to healthcare; therefore, the combination of the two typically results in increased expenditures.
Companies offering dark web monitoring and threat analysis may see an increase in demand. If the results of this research are indicative of a trend in the cyber threat space, then healthcare organizations will require knowledge of what criminals are saying about them in private forums, as well as intelligence regarding evolving threats.
Finally, regulatory scrutiny isn’t going anywhere. Breach costs are still climbing. When a health-related record sells for $300 on the dark web, regulatory agencies take notice.
This means higher penalties and an increase in the number of lawsuits being filed. All of this leads towards healthcare companies using better security systems to prevent breaches from happening in the first place.
The Risk Model
The distinction between health data and credit cards is in how easy it is to contain a credit card breach. Cancellation and re-issuance of a new card is all a victim needs to solve the problem and move on.
On the other hand, information associated with health has a much longer timeline of potential abuse than does information associated with a credit card. Flare’s research indicates that once attackers get their hands on a health record, they have more time to turn it into revenue. This means there is ongoing risk each time that record gets passed from one criminal to another on the dark web.
This is the basis for subscription fee models utilized by cyber security companies. A hospital doesn’t need a one-time fix for a breach; it needs continual monitoring as well as continued visibility into black markets where its data find abuse. And also, they require assistance in developing plans around which data will generate the biggest economic risks.
What this Means for You
If you’ve ever gone to the doctor, your personal information is worth something. Not to you, but to someone on the dark web.
Healthcare places that manage this data are always facing a big risk. The criminals are patient, and they stand to make a lot of money. And the market for stolen health records isn’t slowing down at all.
Flare recently brought this up in their blog post. They looked at the actual prices for health records on real dark web markets. The takeaway is pretty clear: your health record is a popular item. Right now, it’s selling for around three hundred bucks in that online underworld.
