Cyberattacks could cause companies billions in damage. Life Sciences companies, which usually hold highly sensitive and valuable data, are particularly desirable targets for cybercriminals.
During the COVID-19 pandemic, state-backed hackers from China, Russia, and North Korea have allegedly tried to steal COVID-19 research data from other countries 1, 2, 3. In an unsuccessful attempt, AstraZeneca’s staff were approached by suspected North Korean hackers with fake job offers 3. They were sent job description documents that contained malicious code designed to gain access to the victim’s computer.
R&D progress information from publicly traded Life Science companies often causes large swings in stock values 4. In the mid 2010s, cybercriminal groups, such as FIN4 and Butterfly, targeted biopharmaceutical companies to access stock-moving insider information and gain stock trading advantage 4, 5. Major pharmaceutical companies have reportedly been affected.
Apart from the loss of valuable information, companies must also be prepared for the operational disruptions that come with these attacks. In 2017, Merck and Co. (MSD in the UK) was attacked by Russian hackers as part of Russia’s retaliation against companies working in Ukraine 6. This disrupted its worldwide operation, including a vaccine plant shutdown, requiring the company to borrow vaccine doses from the US government to fulfil orders. The company reported that the attack caused US$1.4B in damage 7.
Similarly, a cyberattack affecting medical device maker Stryker in March this year caused delayed product delivery, forcing doctors to postpone some surgeries 8. The attack was performed by a pro-Iranian group in response to the US-Israeli attack. This demonstrates that cyber-defence is not only important to protect intellectual properties, but also because the resulting operational disruptions could harm people’s lives. It also shows the industry’s exposure to geopolitically motivated attacks.
The rapid advancements in artificial intelligence in recent years have ushered in an era of AI-powered cyberattacks with increasing speed, scale, and sophistication 9. In late April this year, Anthropic revealed Claude Mythos - its most powerful AI model yet 9, 10. Mythos can identify vulnerabilities within existing computer systems/networks with unprecedented speed and efficacy, then suggest ways to exploit these weaknesses. It has reportedly spotted thousands of weaknesses in every major operating system/browser - gaps that have been missed over decades of human reviews 9. While users could use the insights provided by Mythos to patch existing gaps and enhance their cybersecurity, malevolent actors could use them to launch destructive cyberattacks.
Given the potential risk to the public, Anthropic has decided to restrict Mythos access to only carefully selected partners. Nevertheless, it might only be a matter of time before ill-intentioned actors set their hands on similar tools. This also comes at a period where geopolitical tensions are high and escalating.
Life Sciences companies are now facing increasing cybersecurity risks due to technological advancements and rising geopolitical tensions. Contingency and continuity plans must be updated to include more potential scenarios. Leaders must stay up to date with the latest cybersecurity advancements and update the organisation’s systems as appropriate. Cybersecurity standards for suppliers and contractors must be set to avoid disruptions through the rippling effect.