Millions of patients possibly at risk due to poor passwords at healthcare orgs - here's how to stay safe

• NordPass and NordStellar reviewed terabytes of data
• The analysis uncovered poor password practices in the healthcare industry
• Organizations are lacking staff training and strong policies

Hygiene in hospitals and clinics is essential, but cyber-hygiene - despite being equally important - is constantly being neglected, experts have warned.

A report from NordPass and NordStellar has claimed weak password practices are “dangerously common” in the healthcare industry.

Based on a review of 2.5TB of data extracted from various publicly available sources (including the dark web), the two organizations found that different medical institutions, including private clinics and hospital networks, all rely on “predictable, recycled, or default passwords” to protect critical systems. As a result, sensitive patient data, and possibly their health, is placed at immense risk.

Carelessness

“When the systems protecting patient data are guarded by passwords like ‘123456’ or ‘P@ssw0rd,’ that’s a critical failure in cybersecurity hygiene. In a sector where both privacy and uptime are vital, this kind of carelessness can have real consequences,” said Karolis Arbaciauskas, head of business product at NordPass.

The report also lists the most frequently used passwords identified in the healthcare sector. If you’re using any of these (or a variant), make sure to change them for something tougher to crack:

• fabrizio19
• 123456
• Melu3@12345
• @Vow2017
• Mercury9.Venus8
• password
• Marty1508!
• Carlton@1988
• 12345678
• @Vowcomm2018
• papa
• 12345
• Durson@123
• P@ssw0rd
• Simetrica
• Raffin2209!
• Asspain28#
• Smith
• neuro
• default

Policies and training

The teams warn passwords that reflect personal names, simple number patterns, or default configurations, are all prime targets for brute-force and dictionary attacks, in which cybercriminals automate the process, and try out countless combinations until they break in.

To make matters even worse - one break-in is more than enough to wreak havoc, as lateral movement can compromise entire networks, expose sensitive data, and result in different malware and ransomware infections.

The report stresses that healthcare institutions “lack clear password management policies or staff training,” which is why they are recommended to enforce strong password policies, eliminate the use of default or role-specific passwords, use a business-grade password manager, train the staff, and introduce 2FA wherever possible.

You might also like

• Major data breach at healthcare giant Yale Health affects 5.5 million people - here's what we know
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers