Today (12th May 2017) news broke of a massive NHS Cyber Attack that has had catastrophic impact on our NHS, leading to a major incident being declared.
Operations have been delayed or cancelled, patients have delayed being discharged from or admitted to hospital, prescriptions have not been issued, A&E has been disrupted … the impact of the NHS cyber attacks continue and sadly there is a real risk that lives may be jeopardised.
Was the NHS Cyber Attack targeted?
According to the BBC News, the attack does not appear to have been limited to the UK with 70+ other countries impacted. A major ransomware attack has unfolded, impacting thousands of users.
What is Ransomware? The NHS Cyber Attacks
Ransomware is typically distributed through email links. When the link is clicked, the ransomware software is installed on your system and holds your data to ‘ransom’ until money has been paid to the criminal. Once paid, your data, in most cases, will be released. The NHS cyber attack used a simple Ransonware called WannaCry which attacks the Windows operating systems.
The demand is for a payment of $300 (£230) in virtual currency Bitcoin to unlock the files.
How does the Ransomware work? The NHS Cyber Attacks
In today’s incident, a vulnerability in Windows software appears to have been exploited. Microsoft issued a patch to their operating system last month and it is believed that the application of this patch would have prevented this incident. The attack on the NHS unfortunately demonstrates the need to apply software updates to systems as soon as they are issued and to not wait days or weeks to do so.
Who is to blame for the NHS Cyber Attacks?
Once again, the blame is being targeted on the IT department and whilst it is too soon to understand the root cause, we reiterate the guidance that the Information Commissioner issued following the fine against Talk Talk. Elizabeth Denham said ‘cyber security is not an IT problem, it is a Board room problem’.
If you are a leader in your organisation, if you are on the Board, you must be asking your IT provider or IT department what systems and applications are not at the right software levels? What assistance does your IT department / provider need to ensure that all systems are up to date ? Has a delay been introduced because there needs to be a reload of the computer system which has yet to be sanctioned ? Have you got up to date virus and malware checking software ? Is this installed on all platforms (e.g. smartphones and tablets) and not just servers, desktops and laptops ? Following the guidance for Cyber Essentials is a great initial step to protecting your organisation. Cyber needs to be a Board room item.
What can you do to prevent NHS Cyber Attacks happening to you?
If you are an employee, we provide simple guidance – Stop, Think, Don’t Click. Ask yourself, am I expecting a parcel, why would I be asked for HMRC / Paypal / Amazon information ? If in doubt go directly to the website of the provider – do not click the link !
The NHS story will continue to run for the next few days and weeks to come and I am sure that we will learn more. In the meantime, there is excellent information on the Action Fraud, GetSafeOnline and the National Cyber Security Centre websites.
Alternatively, give us a call on 01926 800710 and we can help.
