Healthcare organisations in the UK and US have been warned of growing cybersecurity threats emerging in the wake of the Covid-19 pandemic.

The UK’s National Cyber Security Centre (NCSC) and the US Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) have issued an advisory warning of ongoing activity by criminal groups and hostile states against organisations involved in both national and international COVID-19 responses. It describes some of the methods these groups are using to target organisations and provides mitigation advice.

Organisations targeted include healthcare providers, pharmaceutical companies, academia, medical research organisations, and local government.

The agencies say hostile states frequently target organisations in order to collect bulk personal information, intellectual property and intelligence that aligns with national priorities such as research related to Covid-19.

Chris Sherry, regional VP EMEA central at cybersecurity firm Forescout told HealthInvestor UK that that all devices that connect to a network are possible security risks, a consideration often overlooked.

“Medical devices such as infusion pumps, ECG monitors but also CCTV cameras in research labs are all potential targets,” he said.

“Many connected devices carry a default password that nobody has thought to change, giving bad actors and easy way into a network. Equally, many of these devices don’t always run the latest operating system, leaving critical known vulnerabilities unpatched. The damage such a breach can do in a healthcare setting is enormous.

“Factory passwords for new devices should always be changed and devices should always run the latest software and security updates to further reduce the risk of being compromised.  Also, ensuring 100% visibility of every device connected to the network including all medical devices will give any organisation a foundational layer from which a robust security strategy can be built”