>>> A GROWING CONCERN BY HOSPITALS IS CYBER HACKING.

ATTACKS ON HOSPITALS MORE THAN DOUBLED BETWEEN 2016 AND 2021.

2000 CHILDREN'S SURGICAL FOUNDATION PATIENTS SAW THEIR SOCIAL SECURITY NUMBERS LEAKED TO AN UNKNOWN PARTY WITH THEIR NAMES, DATES OF BIRTHS, AND HEALTHCARE THE FBI SAYS IS THE NUMBER ONE ATTACK TARGET IN THE COUNTRY.

WE HAVE ROBERT WAGNER, SECURITY OFFICER WITH ISSA, CHICAGO CHAPTER .

AND PATRICK DOLAN, SECURITY OFFICER AT LRS I.T.

SOLUTIONS.

ROBERT, WHY ARE THEY SO COMMON ON HOSPITALS?

>> A NUMBER OF REASONS, PEOPLE PRESUME THERE IS A LOT OF MONEY BUT HOSPITALS ARE OPERATING IN THE BLACK.

RIGHT NOW , HOSPITALS HAVE BEEN FOCUSED MAINLY ON PATIENT SAFETY AND NOT CYBERSECURITY.

WHEN IT COMES TO SYSTEMS LIKE THESE, THEY HAVE NOT THOUGHT OF THEMSELVES AS BEING A TARGET.

FROM A CRIMINALS POINT OF VIEW, THEY WILL PAY FAST BECAUSE LIVES ARE ON THE LINE.

NO HOSPITAL WANTS TO PUT PATIENT SAFETY AT RISK.

THEY WOULD MAYBE BE MORE LIKELY TO PAY IT THEN A FINANCIAL INSTITUTION.

>> WHAT ARE ATTACKERS TRYING TO STEAL AND WHAT DO THEY DO WITH IT?

>> GREAT QUESTION, PARIS.

THEY ARE LOOKING FOR PATIENT DATA , SPECIFICALLY SENSITIVE DATA , SOCIAL SECURITY NUMBERS , FINANCIAL INFORMATION, HEALTH RECORDS , DATE OF BIRTHS , ADDRESSES , ANYTHING THAT CAN BE USED FOR SETTING UP THE HOSPITAL TO PAY RANSOM.

OR SELLING THAT INFORMATION ON THE DARK WEB.

MULTIPLE DIFFERENT AREAS OR REASONS FOR THESE ATTACKERS TO ATTACK HOSPITALS.

>> YOU TALKED ABOUT THIS, WHAT ARE SOME SINNERS WHERE THIS DISRUPTED A HEALTHCARE SYSTEM ?

>> WITH ONE AGENCY , THEY JUST ALL RECORDS.

OTHERS, AN ATTACK SHUT DOWN A SYSTEM AND A BABY DIED BECAUSE THEY COULD NOT MONITOR THE VITALS OF THE BABY.

>> THIS IS LIFE-AND-DEATH.

PATRICK, WHAT CAN HOSPITALS DO?

>> A COUPLE OF DIFFERENT THINGS.

FIRST, DO THE BASICS WITH CYBERSECURITY.

THAT CAN INCLUDE INCIDENT RESPONSE PLANS , UNDERSTANDING WHO HAS ACCESS TO YOUR DATA , BUT THEY'RE USING IT FOR.

UNDERSTANDING WHERE THE SENSITIVE DATA IS.

PROTECTING END POINTS.

SOMETHING ELSE VERY IMPORTANT IS , HAVING THE EXPERTISE INTERNALLY.

THAT IS AN ISSUE, FINDING TALENT.

HAVING SERVICE PROVIDERS THAT YOU CAN TRUST.

IF THEY BUILT ROBUST CYBERSECURITY PROGRAMS, THOSE ARE THINGS THAT THESE HOSPITALS AND HEALTHCARE ORGANIZATIONS NEED TO FOCUS ON.

>> THEY ARE PAYING THE RANSOM RIGHT AWAY SO THEY CAN GET BACK TO DOING BUSINESS THEY NEED TO DO.

AT WHAT COST ?

>> BILLIONS OF DOLLARS.

IN HEALTHCARE FRAUD.

$380 BILLION LAST YEAR BECAUSE THEY USE THE RECORDS FOR EXTORTION , FRAUDULENT HEALTHCARE , EVEN GETTING EQUIPMENT AND SELLING IT ONLINE.

SOME OF THEM ARE NOT DIFFICULT TO TWO FACTOR AUTHENTICATION CAN REALLY HELP.

IF THEY DON'T HAVE GOOD BACKUPS , THEY CANNOT GET BACK ONLINE FAST.

THAT IS A PROACTIVE THING THAT THEY CAN DO.

>> PATRICK, THE NATURE OF THESE CRIMES , DIFFICULT FOR THE FBI OR LAW ENFORCEMENT TO SOLVE.

AT LEAST IN A TIMELY MANNER?

>> IT CERTAINLY CAN BE.

THE WAY THESE ATTACKERS USE THE LAW ENFORCEMENT AGENCIES, FOR EXAMPLE, HAVING YOU PAY RANSOM , WITH THINGS LIKE BITCOIN, WHICH IS HARDER TO TRACK.

IT CAN BE A BURDEN FOR LAW ENFORCEMENT TO FIND THESE ATTACKERS.

SOMEBODY CAME OUT FROM IBM AND SAID THE AVERAGE TIME IT TAKES TO IDENTIFY A DATA BREACH ITSELF IS 277 DAYS.

THAT IS A LOT OF TIME AFTER THE INITIAL ATTACK.

IT CAN TAKE A LOT OF WORK AND FORENSIC ANALYSIS TO FIND THE ORIGIN OF THESE ATTACKS.

>> HOSPITALS DO NOT HAVE THAT KIND OF TIME.

IN THE OTHER EXAMPLES LOCALLY?

>> TWO HOSPITALS WERE SHUT DOWN BECAUSE OF A RANSOMWARE ATTACK.

THEY ARE OPERATING ON A SMALL MARGIN, THAT CAN STOP THEIR ABILITY TO TAKE MONEY WHICH CAN SHUT THEM DOWN.

THOSE HAPPEN IN ILLINOIS THIS YEAR, ONE IN PERU AND I CANNOT REMEMBER WHERE THE OTHER ONE WAS.

>> PATRICK, WE TALKED ABOUT THE VULNERABILITY.

ANY OTHER INSTITUTIONS THAT ARE VULNERABLE ?

SCHOOLS, GOVERNMENT AGENCIES ?

>> PARIS, ANYBODY DEALING WITH SENSITIVE DATA.

FINANCIAL SERVICES.

YOU CAN THROW THEM IN.

HIGHER EDUCATION.

EVERYBODY AND ANYONE IS A TARGET FOR A CYBER ATTACK.

NOT JUST THE LARGE ORGANIZATIONS.

WE ARE PAST THE POINT WHERE HEALTHCARE , FINANCIAL SERVICES, WHERE THOSE ARE THE MAIN TARGETS, GOVERNMENT AGENCIES AS WELL, IT IS ACROSS