How DMARC helps boost healthcare’s herd immunity to ransomware

With its sudden onset, devastating effects, and long recovery time, ransomware can be best likened to a disease. And no industry knows this better than healthcare. In 2021, there were 1203 attacks on US healthcare institutions alone, and for 11 consecutive years, healthcare has been hit with the heftiest costs for data breaches, largely resulting from attacks like these.

But what makes ransomware such a serious affliction for healthcare providers is that the data breaches and disruptions resulting from attacks have a very human cost. In research carried out by Ponemon Institute, 22% of respondents agreed that ransomware has an impact on increased mortality rates, while PBS uncovered a shocking parallel between ransomware and an uptick in fatal heart attacks.

It’ll only become a more pressing priority for healthcare providers to strengthen their defenses against this affliction as we move into 2022, and DMARC plays a key role in this. 

How does ransomware work?

Ransomware is a type of malware – most often disguised in a phishing email – that once deployed, blocks you from accessing your data through encryption. Cybercriminals then demand a ransom for access to this, otherwise, your data might be lost or leaked. 

What makes companies susceptible to ransomware?

Sensitive data, legacy systems, a widespread attack surface, and digitization all contribute to a company’s vulnerability to ransomware attacks. But not having the essential security protocols in place to secure vital information and infrastructure makes any business vulnerable, and these are often overlooked.

As our CEO Rahul Powar explains, “Primarily what makes companies susceptible to ransomware attacks is a lack of the basic infrastructure and protocols which are designed specifically to mitigate these risks. Businesses should be asking themselves if they have protocols like DMARC in place to stop exact impersonation attacks, if their inbound protection like SEGs or Advanced Threat Protection products are in order, and whether sufficient awareness training has been provided. Ransomware attackers will take any opportunity to hit an organization with a lot of sensitive data, and the more robust, standardized solutions businesses can put in place to plug the gaps, the better protected they are.” 

Why is healthcare such a lucrative target for cybercriminals?

There are a number of reasons why ransomware is so rife in healthcare:

  • Healthcare organizations store mass amounts of very sensitive data, and cybercriminals know this. 
  • It’s a sector which is rapidly digitizing, meaning there are vulnerabilities if the right measures aren’t in place.
  • There’s a widespread attack surface with many staff who’ve often not received adequate security awareness training in many areas.
  • Large supply chains and alot of third-party outsourcing, meaning there are more endpoints and opportunities for attack.
  • Legacy systems and outdated processes contribute too.

“Healthcare organizations are lagging behind other verticals in cybersecurity defenses because they do not invest enough on cybersecurity protection and are known to be vulnerable to attacks. Some of the basic protections against cyberattacks are not deployed and hence they are easy targets for hackers. Attacks on healthcare have a higher impact from the perspective of lives lost or physical harm as data or critical systems are compromised, as well as the sensitivity of the data being exposed.”

Issam Bandak, Red Sift Director of Sales Engineering

How can protocols like DMARC help create herd immunity in the healthcare sector?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It’s a globally standardized email authentication protocol that protects domains from exact domain impersonation or ‘email spoofing’. Essentially, when implemented properly at a policy of p=reject, it ringfences your domain (www.example.com) and blocks hackers from being able to use it to impersonate your business and send phishing emails to your patients, employees, and supply chain.

Given that 90% of cyber attacks start with an email, and 90% of malware is delivered via spam email, DMARC is an essential – and surprisingly cost-effective – way for providers to secure this particularly vulnerable vector. Better still, the more organizations that adopt it, the fewer domains are on offer for hackers to impersonate for phishing attacks, BEC, ransomware, and vendor fraud. That’s where the concept of herd immunity comes in; if every organization implements DMARC, then ransomware will be driven down, and healthcare organizations, their data, suppliers, and most importantly patients, will be better protected.

Get your free DMARC health check today

At Red Sift, we’re passionate about democratizing the technology essential to cybersecurity – in short making it easy and accessible for everyone. So take the first step to DMARC protection today and get your free DMARC, SPF, and DKIM health check using our investigate tool.

Check email DMARC setup

PUBLISHED BY

Sabrina Evans

11 Feb. 2022

SHARE ARTICLE:

Categories

Recent Posts

VIEW ALL
Certificates

TLS certificates are changing: What you need to know

Red Sift

Executive summary: TLS certificates are about to get significantly shorter-lived. Starting 15 March 2026, newly issued public-trust certificates will max out at 200 days—and just three years later, that lifespan drops to 47 days. Backed by Google, Apple, and Mozilla, this shift aims to make the web safer through fresher data, faster failover, and…

Read more
DKIM

The hidden threat: How misconfigured DKIM enables replay attacks

Red Sift

Email authentication isn’t just an IT concern. It protects your brand and customers. A single misstep can let attackers spoof your domain, send phishing emails, and destroy customer trust. One of the most dangerous methods? The DKIM replay attack. In this post, we’ll break down how undersigned DKIM keys and related misconfigurations open your…

Read more
BIMI

Why DMARC and BIMI are a business priority

Jack Lilley

Email threats aren’t slowing down, and neither should your authentication strategy. In our recent joint webinar with Marigold, “From DMARC to BIMI: Navigating the New Email Authorization Landscape,” we broke down what today’s evolving standards mean for both security and marketing teams—and how to take action now with our free Red Sift Investigate tool.…

Read more
ASM

Zoom stops zooming: Why active monitoring is essential

Billy McDiarmid

​On April 16, 2025, Zoom experienced a significant global outage that disrupted video conferencing services and access to its website for thousands of users, as well as their corporate email for all their employees. It was quickly identified as a domain name registration status problem. Despite being a critical name for Zoom, somehow, the…

Read more