News of the attack first hit on Friday, May 12, 2017 when NHS staffers reported they were unable to access their IT systems and posted pictures online of computer screens showing a ransomware message. Such programs stop users from accessing their files until they make a payment in Bitcoin. The black-out at the NHS was triggered by the ransomware program WannaCrypt.
A feared second spike in the attack failed to materialize on Monday, May 15, 2017; however, the healthcare system was still disrupted. Routine surgeries and appointments with general practitioners were cancelled. And in some areas the disruption is expected to continue into Tuesday, May 16, 2017.
Beyond that, the NHS must try to protect its systems from future attacks. The healthcare system remains unusually-reliant on technology running Windows XP, an old operating system that is more vulnerable to attack than modern alternatives. Microsoft released a security update in March to protect against WannaCrypt but Windows XP was excluded from the patch. After the NHS attack, Microsoft provided a security update for technology running Windows XP.
How helpful that is to the NHS remains to be seen. While it should be possible to patch and protect NHS computers running Windows XP, if the healthcare system also has medical equipment such as MRI machines that run the operating system it may be harder to completely protect the network. Such issues are solvable; however, the NHS is overstretched financially and has a patchy record of rolling out IT products, in part because of the small cadre of outsourcing providers it relies on have failed to deliver the anticipated results.
The NHS is far from the only healthcare system vulnerable to such attacks, though. Last year a hospital in Los Angeles paid $17,000 to regain control of its IT system following a ransomware attack.
REFERENCE: FierceBioTech; 15 MAY 2017; Nick Paul Taylor