Abstract:Background: Over the last decade, the frequency and size of cyberattacks in the health care industry have increased, ranging from breaches of processes or networks to encryption of files that restrict access to data. These attacks may have multiple consequences for patient safety, as they can, for example, target electronic health records, access to critical information, and support for critical systems, thereby causing delays in hospital activities. The effects of cybersecurity breaches are not only a threat to patients' lives but also have financial consequences due to causing inactivity in health care systems. However, publicly available information on these incidents quantifying their impact is scarce. Objective: We aim, while using public domain data from Portugal, to (1) identify data breaches in the public national health system since 2017 and (2) measure the economic impact using a hypothesized scenario as a case study. Methods: We retrieved data from multiple national and local media sources on cybersecurity from 2017 until 2022 and built a timeline of attacks. In the absence of public information on cyberattacks, reported drops in activity were estimated using a hypothesized scenario for affected resources and percentages and duration of inactivity. Only direct costs were considered for estimates. Data for estimates were produced based on planned activity through the hospital contract program. We use sensitivity analysis to illustrate how a midlevel ransomware attack might impact health institutions' daily costs (inferring a potential range of values based on assumptions). Given the heterogeneity of our included parameters, we also provide a tool for users to distinguish such impacts of different attacks on institutions according to different contract programs, served population size, and proportion of inactivity. Results: From 2017 to 2022, we were able to identify 6 incidents in Portuguese public hospitals using public domain data (there was 1 incident each year and 2 in 2018). Financial impacts were obtained from a cost point of view, where estimated values have a minimum-to-maximum range of €115,882.96 to €2,317,659.11 (a currency exchange rate of €1=US $1.0233 is applicable). Costs of this range and magnitude were inferred assuming different percentages of affected resources and with different numbers of working days while considering the costs of external consultation, hospitalization, and use of in- and outpatient clinics and emergency rooms, for a maximum of 5 working days. Conclusions: To enhance cybersecurity capabilities at hospitals, it is important to provide robust information to support decision-making. Our study provides valuable information and preliminary insights that can help health care organizations better understand the costs and risks associated with cyber threats and improve their cybersecurity strategies. Additionally, it demonstrates the importance of adopting effective preventive and reactive strategies, such as contingency plans, as well as enhanced investment in improving cybersecurity capabilities in this critical area while aiming to achieve cyber-resilience.

What happens to rural hospitals during a ransomware attack? Evidence from Medicare data

Characteristics of short-term acute care hospitals that experienced a ransomware attack from 2016 to 2021

When all computers shut down: the clinical impact of a major cyber-attack on a general hospital

Can we learn from an imagined ransomware attack on a hospital at home platform?

US hospitals face collapse as cyberattack on UnitedHealth cuts revenue streams

Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study

It's more than just money: The real-world harms from ransomware attacks

Radiation Oncology Ransomware attack response risk analysis using FMEA

The effects of the COVID-19 pandemic on urban and rural hospital profitability

An Empirical Study of Data Disruption by Ransomware Attacks

Volenti non fit injuria: Ransomware and its Victims

Ransomware threat mitigation through network traffic analysis and machine learning techniques

A Prevention and a Traction System for Ransomware Attacks

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

Ransomware: A Rising Threat of new age Digital Extortion

Mitigating the Effects of Ransomware Attacks on Healthcare Systems

Cyberattacks are hitting research institutions — with devastating effects

Showing the Receipts: Understanding the Modern Ransomware Ecosystem

An exploratory data analysis of malware/ransomware cyberattacks: insights from an extensive cyber loss dataset

Ransomware Reloaded: Re-examining Its Trend, Research and Mitigation in the Era of Data Exfiltration

Ransomware deployment methods and analysis: views from a predictive model and human responses