HIMSS 2024: Lessons from the Change Healthcare cyberattack

Orlando, Florida – The Change Healthcare cyberattack has affected hospitals and other providers across America, and it’s prompting health systems to look at their own defenses.

Steve Cagle, CEO of Clearwater, a cybersecurity firm, presented a session during the HIMSS Global Health Conference & Exhibition. He spoke with Chief Healthcare Executive® about the implications of the Change Healthcare attack, the impact on providers, and what the health industry can learn from the attack.

Cagle talked with Chief Healthcare Executive® Wednesday, the same day the U.S. Department of Health & Human Services said it is investigating Change Healthcare and UnitedHealth Group, its parent company, due to the attack.

“We are working in a much more interconnected ecosystem in healthcare,” Cagle said. “And we need to ensure that every aspect of that ecosystem is taking cybersecurity and risk, around the systems that we're using, the data that we have, very, very seriously, and that we're continuing to evaluate that risk on an ongoing basis.”

• Read more: Change Healthcare cyberattack shows ‘no one is immune’ | HIMSS 2024

Ransomware groups are also engaging in more sophisticated attacks, Cagle said. So health systems need to realize that even if cybersecurity defenses are succeeding today, they may not be effective in the future.

“I think it's very apparent that we are seeing a much higher level of attack from threat actors who are targeting health care," he said. "And they're doing that for a number of reasons. One, because it's, it's been very successful, and they've been able to make a lot of money doing that. And that's not going to stop.”

“So as a business leader, as an executive, as a CEO, as a board member, this is an issue that really needs to be at the highest level of your attention,” Cagle said.

Ransomware groups are also using AI tools to launch more damaging attacks.

“They're absolutely using AI tools,” Cagle said. “I can't say whether the AI tools were used for the change healthcare attack. But they're definitely being used for things such as having much more sophisticated social engineering campaigns, being able to learn about an organization's defenses, being able to look for vulnerabilities.”

On the upside, organizations are using AI-powered tools to deter ransomware groups, Cagle said.

“It's a bit of a cat and mouse game,” Cagle said. “So you're always going to see advances on both sides, like you would when you have any type of adversary. So that's how we need to think about the challenge that we have ahead of us. This is going to be a continued increase in investment and response and planning.”

“And you know, we need to be prepared,” he said. “It's a long game.”

• Read more: A health system’s lessons from a ransomware attack | HIMSS 2024