How Businesses Can Learn from Ascension’s Cybersecurity Breach

Key Takeaways:
  • A single vulnerability in a business’s network or device can expose the entire system to cyber threats.
  • The average cost of a cyberattack for a business is around $200,000.
  • A cybersecurity program consists of a comprehensive set of policies, procedures and technologies designed to protect computer systems, networks and data from unauthorized access, use, theft or damage.

 

Today’s world has become more interconnected. Think about it. You get email on your watch. The website you had open on your desktop can be waiting for you on your phone to pick up where you left off. You can use your devices to see where your loved ones are and ensure they are safe. This provides peace of mind to many people. But as technology aims to make your life easier, it comes with tremendous risk.

Cybersecurity has emerged as one of the biggest risks businesses face today, regardless of size or industry.

The Ascension Cyberattack: A Stark Reminder

A recent cyberattack on Ascension, a major healthcare provider, is a stark reminder of the importance of robust cybersecurity measures. Hackers infiltrated Ascension’s systems and accessed sensitive patient data, including personal health information. The attackers then demanded a ransom for the data’s release, causing significant operational disruptions, financial losses and reputational damage to Ascension.

This incident highlights the potential consequences of inadequate cybersecurity protections and underscores the urgent need for businesses to fortify defenses against cyber threats.

Cybersecurity’s Importance Cannot Be Overstated

It’s a combination of an increase in cyberattacks along with an increasing reliance on technology that has made it imperative for businesses to prioritize cybersecurity. Every company, from small startups to large corporations, must have a strong cybersecurity plan to protect its data, assets and reputation.

With the rise of cloud computing, mobile devices and the Internet of Things (IoT), businesses are becoming more interconnected and reliant on technology. While these technologies bring many benefits, they also increase the risk of cyberattacks. A single vulnerability in a business’s network or device can expose the entire system to cyber threats.

Cyberattacks have become more sophisticated and prevalent in recent years.

According to a study by Hiscox, a global insurance company, the average cost of a cyberattack for a business is around $200,000.

This amount can be much higher for larger organizations, where a data breach can cost millions.

That’s why you need to protect sensitive data. Think about all the data you have from customer or patient information to financial data to intellectual property. What impact would it have on your business if this data were to become inaccessible? Public knowledge? Lost forever? The damage to your business’s reputation will be substantial. The loss of sensitive information can result in legal action.

A cyberattack can also disrupt business operations, leading to downtime and a loss of revenue and productivity. Significant financial losses can set you back years. In a worst-case scenario, it could cause you to close your doors.

Government Regulations Mandate Cyber Protections

Governments worldwide have introduced laws and regulations that place significant responsibilities on businesses that collect, store and process sensitive data. There are data protection regulations you must follow such as the European Union’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA). They require businesses to protect personal data and provide individuals with control over how data is used. This includes implementing appropriate security measures to protect against unauthorized access, disclosure or misuse of personal data.

There are also industry-specific regulations. Certain industries have specific regulations that require businesses to maintain particular cybersecurity standards. The following are some of the bigger laws that may impact your business:

  • Healthcare: The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for the privacy and security of protected health information.
  • Finance: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to implement measures to protect customer data, including the development of written information security plans.
  • Energy: The North American Electric Reliability Corporation (NERC) develops and enforces standards for the reliable operation of the bulk power system in North America, including cybersecurity requirements.
  • Defense: The Defense Federal Acquisition Regulation Supplement (DFARS) imposes cybersecurity requirements on contractors doing business with the Department of Defense, including the implementation of the NIST SP 800-171 security controls.
  • Retail: The Payment Card Industry Data Security Standard (PCI DSS) sets requirements for the protection of credit card data, including network security, vulnerability management and access control.

Companies listed on stock exchanges or operating in regulated industries may have cybersecurity disclosure requirements, too. The U.S. Securities and Exchange Commission (SEC) requires public companies to disclose cybersecurity risks and incidents with material impact.

There are also breach notification requirements that mandate all businesses notify individuals whose personal data has been compromised in a data breach. While there is no federal breach notification law in the U.S., many states have their own laws. These laws vary by state but generally require businesses to notify affected individuals of a breach in a timely manner.

Cybersecurity Provides Protection

Cybersecurity protects against a wide range of security threats. It helps prevent unauthorized access and protects data from theft or exposure. By investing in cybersecurity measures, you can reduce your risk of being hacked or compromised, protect your data and maintain the trust.

A cybersecurity program consists of a comprehensive set of policies, procedures and technologies designed to protect computer systems, networks and data from unauthorized access, use, theft or damage.

A well-designed cybersecurity program can help to reduce risk by:

  • Identifying and assessing the risks that the business faces
  • Implementing controls to mitigate those risks
  • Educating employees on cybersecurity best practices
  • Testing and monitoring the effectiveness of the controls
  • Having a plan for responding to a cyberattack

By implementing a well-designed cybersecurity program, you can better protect yourself against a wide range of security threats and maintain the confidentiality, integrity and availability of data and systems. Bad actors are looking for easy targets. Don’t be one of them!

If you would like to discuss developing a cybersecurity plan for your company, contact an Adams Brown Technology Specialist.