Hospitals throughout the U.K. were hit with a massive ransomware attack that has affected providers’ and staffers’ ability to access patient data and has resulted in the diversion of ambulances, according to media reports on May 12.
According to a report in CNN, “At least 16 organizations connected to the National Health Service (NHS) in England reported being affected.” Other media outlets are reporting that as many as 25 institutions have been impacted, with most of the attacked patient care entities affected located in England and Scotland.
The NHS in England deals with over 1 million patients every 36 hours; it’s one of four National Health Services of the U.K. Overseen by the Department of Health, the system provides healthcare to every legal resident in England, with most services free at the point of use.
A statement on the website of NHS Digital, a public body of the Department of Health in England, and a national provider of information, data and IT systems for healthcare organizations, read: “The investigation is at an early stage but we believe the malware variant is Wanna Decryptor. This attack was not specifically targeted at the NHS and is affecting organizations from across a range of sectors. At this stage we do not have any evidence that patient data has been accessed.” The statement continued, “NHS Digital is working closely with the National Cyber Security Centre, the Department of Health and NHS England to support affected organizations and ensure patient safety is protected.”
The CNN report, meanwhile, further noted, “Health workers reported being locked out of their systems and seeing messages demanding ransom payments to regain access. NHS England described the incident as a ‘ransomware’ attack. Routine appointments had to be cancelled and ambulance were being re-routed to nearby hospitals, the report stated.
Who’s the Attacker and What's the Impact?
According to a story in MetroUK, “a pop-up was revealed in a screenshot obtained by the Health Service Journal (HSJ) that said: ‘Your important files are encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service.’” The attacker went on to give a demand of $300 worth of Bitcoin and a deadline of May 19 before the files would be deleted, according to this report.
Indeed, the NHS cyber attack seems to be one part of a bigger attack that has spread across multiple continents, impacting various industries. Reaction to this major attack, and what impact it might have worldwide, has already started to pour in.
In an emailed statement, Mounir Hahad, Ph.D., senior director at Santa Clara, Calif.-based network security company CyphortLabs, said, “There is cause for alarm in the U.S. as well given the speed at which this attack has spread and the fact that it seems to know no border. This ransomware seems to exploit a vulnerability in the Windows file sharing protocol SMBv1 that was patched by Microsoft two months ago. We know of several organizations that have taken steps to completely eradicate this protocol from their networks, and yet, so many PCs worldwide remain unpatched and vulnerable. This shows how quickly criminals are able to adopt newly exposed vulnerabilities and how slow the rest of us are to patch.”
Similarly, according to Creighton Magid, a partner at the international law firm Dorsey & Whitney, while most media reports are focusing on the cybersecurity and data breach implications in this incident, there is a much more dangerous issue that needs to be addressed that could endanger lives.
“The cyberattack, using a ransomware bug known as WannaCry, appears to have used an NSA exploit known as ‘Eternal Blue’ that was disclosed on the web by Shadow Brokers. Microsoft released a patch earlier this year to address the vulnerability, but it appears that a number of hospitals and other users have not applied the patch,” Magid says. “Like the DDOS attack last October, this attack shows that interconnected devices and systems are vulnerable to attack by nations, non-state actors and just plain crooks,” he says, adding that an attack of this scope points to the potential for an entirely different type of damage: shutting down entire businesses, hospital systems, banks, and critical infrastructure.
Meanwhile, the news has already hit home for many providers operating in the U.S. Live at Healthcare Informatics’ HIT Summit in Chicago, Sriram Bharadwaj, CISO, UC Irvine Health, in Irvine, Calif., said, “We are taking precautions to isolate backups, to manage Internet traffic, and to allow our end-users to make sure that the systems are patched, and appropriate scans are in place to identify any vulnerabilities across all systems. We are not seeing any hits from this, but we’ve been informed that there are other entities outside healthcare, but within the U.S., that are getting hit right now."
Further regarding the impact that this might have on the healthcare industry, Alvaro Hoyos, CISO of OneLogin, a San Francisco-based identity and access management solutions provider, notes that the attacks highlight two major areas of risk for organizations—end users and unpatched systems. “You can trace most of the high profile attacks over recent years to these two key areas. This is the latest one you can add to the list.”
ᐧ
