Ransomware attacks more than quadrupled in 2016, with nearly half happening in the healthcare sector, according to a recent report that looked at multiple industries and found hackers setting their sights on on the healthcare industry. 

The Beazley Breach Insights report comes at a time when healthcare and information security executives are struggling to understand how best to protect against and react to ransomware attacks against the backdrop of an increasingly sophisticated threat landscape. Just last week the IBM X-Force Threat Intelligence Index found that, across all industries, 2016 saw 4 billion records compromised, the most in any year on record.

In the Beazley report, published earlier this year, the cybersecurity vendor outlined four steps that healthcare organizations can take to help protect their data: deploying prevention and detection tools, using threat intelligence services, training managers and employees on cybersecurity and threat awareness, and conducting risk assessments focused on identifying and protecting sensitive data.

[Also: Healthcare data attacks fell, but cybercriminals have new target with unstructured data]

In all industries Beazley covers, including healthcare, higher education and financial services, there were about 25 ransomware attacks in 2014, about 50 in 2015, and 200 in 2016, the report found. Beazley projects these attacks will double from 2016 to 2017, hitting 400.

Overall, unintended disclosure – misdirected faxes and e-mails or the improper release of discharge papers – led to 40 percent of data breaches in the healthcare industry in 2016, up from 30 percent in 2015, the Beazley Breach Insights report said. In a sign that the industry might be improving defenses, hacks and malware accounted for only 19 percent of breaches in 2016, down from 27 percent in 2015, according to the report.

Organizations appear to be particularly vulnerable to attacks during IT system freezes and at the end of financial quarters, the report said. Evolving ransomware variants enable hackers to methodically investigate a company’s system, selectively lock the most critical files, and demand higher ransoms to get the more valuable files unencrypted, Beazley found.

[Also: Insider threat health data breaches doubled in February]

The rise of unintended disclosure as a breach cause indicates that formerly small mistakes now have the potential to quickly lead to large data breaches, the report explained. Employee education and training, up to date IT system protections, and an incident response plan for when a breach occurs continue to be the best defenses against these attacks, Beazley said.

According to Beazley, four steps organizations can take to help protect their data include deploying prevention and detection tools, using threat intelligence services, training managers and employees on cybersecurity and threat awareness, and conducting risk assessments focused on identifying and protecting sensitive data.

Twitter: @SiwickiHealthIT