The Government and NHS bosses have been called upon to answer questions as to how hospitals were allowed to become victims of a global cyber attack that took down services and caused chaos during the weekend.
Hackers demanding a ransom managed to infiltrate the NHS’ computer systems, forcing operations and appointments to be cancelled, as over 40 hospital trusts became the victims of a ransomware attack, demanding payment to regain access to patient medical records.
Mikko Hypponen, chief research officer at the Helsinki-based cybersecurity company F-Secure, called the attack “the biggest ransomware outbreak in history,” with over 57,000 infections in 99 countries.
The NHS has said that at this point there is no evidence to suggest that the hackers had managed to access patient records.
It is thought that a computer hacking group, going under the name ‘Shadow Brokers’, was partly responsible for the attack after it leaked a hacking tool called ‘Eternal Blue’ online in April, developed by the US National Security Agency (NSA) as a weapon to gain access to computers used by terrorists. Other online criminals are thought to have picked up the information online and modified it for their own monetary gains.
Experts have questioned why the health service hadn’t updated its security effectively to prevent the ransomeware from taking hold, with suggestions that 90% of NHS trusts in the UK were using Windows XP, an operating system over 16 years old. Computers using operating software introduced before 2007 were particularly vulnerable. Other computers using newer systems may have failed to apply recent security updates which would have offered better protection.
Writing on his blog, Brad Smith, chief legal officer at Microsoft, said that Governments across the world should treat the attack as a “wake-up call” and feel a “renewed determination for more urgent collective action.” Microsoft had provided free software to protect computers back in March and would be pushing out automatic Windows updates to defend clients from WannaCry ransomware.
“As cybercriminals become more sophisticated, there is simply no way for customers to protect themselves against threats unless they update their systems,” Smith said. “Otherwise they’re literally fighting the problems of the present with tools from the past.
“We need the tech sector, customers, and governments to work together to protect against cybersecurity attacks. More action is needed, and it’s needed now.”
Shadow health secretary Jonathan Ashworth said the attack was “terrible news and a real worry for patients” and urged the Government to be “clear about what’s happened.”
The Prime Minister said: “We are aware that a number of NHS organisations have reported that they have suffered from a ransomware attack. This is not targeted at the NHS, it’s an international attack and a number of countries and organisations have been affected.
“The National Cyber Security Centre is working closely with NHS digital to ensure that they support the organisations concerned and that they protect patient safety. And, we are not aware of any evidence that patient data has been compromised.”
WannaCry, also known as Wanna Decryptor, demands each user affected pay $300 in the internet currency Bitcoin to release and restore files. Thousands of computers across the NHS have been affected, potentially costing taxpayers millions of pounds.
