Why Do Vaccine Supply Chains Need Better Cybersecurity Now?

Article by Emily Newton

In 2021, IBM researchers uncovered what is likely one of the most important cyberattacks of the 21st century so far. The year before, hackers began working to access information related to the vaccine cold chain — including data on how the shots were shipped and distributed.

The attack targeted 44 companies across 14 countries. While it did not disrupt the flow of vaccines, hackers may have been able to gain access to a vast amount of confidential information on vaccine shipping.

As cyberattacks become more common, companies involved in vaccine logistics will need better cybersecurity to defend against potential disruption and data breaches caused by hackers.

Why Hackers Are Targeting the Vaccine Cold Chain

The global vaccine cold chain, responsible for moving vials of the various COVID-19 vaccines around the world, has become essential infrastructure.

While there has already been a significant rollout of the vaccines in the U.S., much of the world still has no access to any COVID-19 vaccine.

As businesses and government actors work to extend the supply chains around the world, they’re facing a new threat — attacks from cybercriminals interested in access to enterprise networks.

Ransomware and the potential for the theft of confidential information mean there is serious value in attacking the vaccine supply chain.

How Hackers Could Threaten the Vaccine Cold Chain

While the 2020 vaccine hack didn’t directly disrupt the cold chain, it’s possible that future attacks could slow or halt the delivery of vaccines.

Ransomware attacks are becoming increasingly common around the world. Businesses and organizations of all kinds — including school systems and local government offices — have had their files held to ransom by hackers, typically in exchange for large cryptocurrency payments.

These attacks typically use phishing to exploit one of the most common organizational cybersecurity weak points — employees who have received little or no cybersecurity training, but who have significant network access.

In the case of the COVID-19 vaccine hack, attackers targeted executives and other high-level officials with significant network access. Phishing attacks that target people in this way are successful often enough that they pose a major risk to almost any organization with information worth targeting.

For businesses managing the vaccine cold chain, ransomware attacks could be even more devastating than usual, due to the time-sensitive nature of vaccine delivery. A large number of pharmaceutical products, including several COVID-19 vaccines, need to be held at specific low temperatures for the entire time they are in transit from manufacturing to customer.

A ransomware attack could significantly disrupt the movement of vaccines — both delaying their delivery and potentially causing a large number of doses to spoil.

Companies pressured to pay the ransom may also find that the hackers don’t release files and essential systems upon payment — meaning that agreeing to hackers’ demands may not be enough for the supply chain to continue moving.

Even if hackers are only after information — as they were in the 2020 attack on the vaccine supply chain — the long-term impact of a hack can still be serious. Information leaked from data breaches can put individuals at risk, expose the supply chain to future attacks, and make it more difficult for businesses to deliver vaccines.

Defending the Cold Chain Against Cyberattack

It’s likely that simple defensive measures could go a long way in preventing future breaches. The 2020 hack of the COVID-19 vaccine cold chain was caused by a phish, for example, rather than more technical measures.

Better training could have prevented the hack. Teaching all employees how to avoid a phish, for example, can provide good protection against this kind of attack. High-level management and executives should also receive this training. Because they often have high-level access to the network, hackers can target them more frequently than lower-level employees.

On average, this kind of training can take just a few hours — and can help businesses save millions of dollars or more by preventing a data breach.

Adopting a zero-trust approach will also likely be essential for effective defense. The zero-trust model assumes that users may have had their identities compromised, and that a company can’t necessarily trust everything inside the organizational network.

By using techniques like network segmentation, businesses can use the zero-trust model to protect their most critical assets — systems that are essential to vaccine logistics, confidential information, and similarly valuable resources.

It’s also important that the zero-trust model and cybersecurity training extends outside major supply chain stakeholders to include junior partners, like small businesses. In the past, major hacks of businesses like Facebook were often caused when smaller business partners with access to confidential information or business networks fell victim to a hack.

Despite their smaller size, these junior partners are often targeted by hackers. They will also benefit from cybersecurity training and simple cybersecurity defenses.

The Vaccine Supply Chain Under Pressure

As cyberattacks become more common in general, the vaccine cold chain will likely face greater pressure from hackers. Companies involved in vaccine logistics should begin securing their networks now to defend against hackers interested in holding files for ransom or acquiring sensitive vaccine information.

Simple defenses — like phishing training and network segmentation — could provide these businesses with some serious protection against hackers without significantly disrupting day-to-day work.

##

About the Author

Emily Newton is the Editor-in-Chief of Revolutionized, where she covers industrial, engineering, and science topics.