Massive Ransomware Attack Spreading Across U.K. Hospitals | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Massive Ransomware Attack Spreading Across U.K. Hospitals

May 12, 2017
by Rajiv Leventhal
| Reprints
The IT systems of up to 25 patient care organizations have been impacted by a major security attack that is part of a larger worldwide outbreak, according to media reports

Hospitals throughout the U.K. were hit with a massive ransomware attack that has affected providers’ and staffers’ ability to access patient data and has resulted in the diversion of ambulances, according to media reports on May 12.

According to a report in CNN, “At least 16 organizations connected to the National Health Service (NHS) in England reported being affected.” Other media outlets are reporting that as many as 25 institutions have been impacted, with most of the attacked patient care entities affected located in England and Scotland.

The NHS in England deals with over 1 million patients every 36 hours; it’s one of four National Health Services of the U.K. Overseen by the Department of Health, the system provides healthcare to every legal resident in England, with most services free at the point of use.

A statement on the website of NHS Digital, a public body of the Department of Health in England, and a national provider of information, data and IT systems for healthcare organizations, read: “The investigation is at an early stage but we believe the malware variant is Wanna Decryptor. This attack was not specifically targeted at the NHS and is affecting organizations from across a range of sectors. At this stage we do not have any evidence that patient data has been accessed.” The statement continued, “NHS Digital is working closely with the National Cyber Security Centre, the Department of Health and NHS England to support affected organizations and ensure patient safety is protected.”

The CNN report, meanwhile, further noted, “Health workers reported being locked out of their systems and seeing messages demanding ransom payments to regain access. NHS England described the incident as a ‘ransomware’ attack. Routine appointments had to be cancelled and ambulance were being re-routed to nearby hospitals, the report stated.

Who’s the Attacker and What's the Impact?

According to a story in MetroUK, “a pop-up was revealed in a screenshot obtained by the Health Service Journal (HSJ) that said: ‘Your important files are encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service.’” The attacker went on to give a demand of $300 worth of Bitcoin and a deadline of May 19 before the files would be deleted, according to this report.

Indeed, the NHS cyber attack seems to be one part of a bigger attack that has spread across multiple continents, impacting various industries. Reaction to this major attack, and what impact it might have worldwide, has already started to pour in.

In an emailed statement, Mounir Hahad, Ph.D., senior director at Santa Clara, Calif.-based network security company CyphortLabs, said, “There is cause for alarm in the U.S. as well given the speed at which this attack has spread and the fact that it seems to know no border. This ransomware seems to exploit a vulnerability in the Windows file sharing protocol SMBv1 that was patched by Microsoft two months ago. We know of several organizations that have taken steps to completely eradicate this protocol from their networks, and yet, so many PCs worldwide remain unpatched and vulnerable. This shows how quickly criminals are able to adopt newly exposed vulnerabilities and how slow the rest of us are to patch.”

Similarly, according to Creighton Magid, a partner at the international law firm Dorsey & Whitney, while most media reports are focusing on the cybersecurity and data breach implications in this incident, there is a much more dangerous issue that needs to be addressed that could endanger lives.

“The cyberattack, using a ransomware bug known as WannaCry, appears to have used an NSA exploit known as ‘Eternal Blue’ that was disclosed on the web by Shadow Brokers.  Microsoft released a patch earlier this year to address the vulnerability, but it appears that a number of hospitals and other users have not applied the patch,” Magid says. “Like the DDOS attack last October, this attack shows that interconnected devices and systems are vulnerable to attack by nations, non-state actors and just plain crooks,” he says, adding that an attack of this scope points to the potential for an entirely different type of damage:  shutting down entire businesses, hospital systems, banks, and critical infrastructure. 


Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More