Keep Data Secure

Pharma companies, which keep valuable data, are vulnerable to cyber attacks as these can be monetised by criminals. Once India passes the Personal Data Protection Bill such breaches should be fewer

- Na Vijayshankar

THREE major cyber attacks in the Indian pharma industry in the last few months have left people wondering whether there is a pattern indicating the reason for this spurt. First was the Breach Candy Hospital one in February 2020 where over 121 million medical records were compromised. Of these, 120 million were images stored in the Digital Imaging and Communications in Medicine system consisting of X-rays, scan reports, etc. One million records contained Aadhaar information, medical history, etc. The data breach reportedly occurred because the access system of the hospital was compromised. Though this was an alarming data breach, the matter was hushed up and there was no apparent investigation by the Indian Computer Emergency Response Team (CERT-IN) or any further announcements in the media.

In October 2020, Dr Lal PathLabs reported a data breach of millions of records because their Cloud records reportedly did not have a password for access. Again, this was brushed under the carpet and no action was initiated by CERT-IN.

More recently, Dr Reddy’s Laboratories, which was testing a Covid vaccine from Russia, was attacked. Questions must be asked whether the lack of prompt action by CERT-IN earlier emboldened the criminals to continue their attacks on these pharma companies, which are soft targets holding highly valuable data assets.

The first reaction when such cyber incidents are reported is to find out how the breach occurred, whether there were any vulnerabilities in the technical architecture or whether there was failure of controls. But the possibility of insider frauds causing such breaches cannot be ruled out since negligence and failure of information security are easily visible to the extent that ignorance alone cannot be the cause of these attacks.