Mapping the Cyberthreat Landscape in Healthcare Using GDELT: A Multimethod Approach

Cyberattacks that target critical national infrastructure, such as hospitals, pose a significant threat to the safety and wellbeing of individuals, as evidenced by incidents like the WannaCry worldwide ransomware attack. To better understand vulnerabilities within the healthcare sector and develop preventive measures, it is crucial to examine the evolving nature of cyberthreats and the types of attacks occurring. In this article, we describe a multimethod approach comprising social networks analysis, natural language processing, and machine learning, using data from GDELT (Global Database of Events, Language, and Tone), to identify the prevalence of attacks on hospitals while considering the type of attack and its date. Through this approach, meaningful patterns in the evolution of cyberattacks are revealed by analyzing the relationships between emerging cyberattacks mentioned in news reports. Findings show that the number of attacks from 2017 to 2023 increased substantially, with hospitals being more prone to critical attacks such as cyberterrorism/state actor-sponsored criminal activities, advanced persistent threats, and distributed denial of service. Mapping real-time data from diverse sources using a multimethod approach, such as the framework proposed in this article, can lead to better understanding of the threat landscape. This is a crucial step in determining necessary cyberdefenses and informing the development of policy interventions to ensure the cybersecurity of critical national infrastructure.