Cyber attack delayed cancer treatment at NHS hospital
The incident at Wirral University Teaching Hospital delayed critical treatments
An NHS hospital has admitted its cancer treatment wait times increased in the wake of a cyber attack that took down its systems at the end of last year — and it will take many months to recover.
Last November, NHS hospitals and health centers that make up Wirral University Teaching Hospital Trust in Merseyside were hit by a major cybersecurity incident, with appointments cancelled and patients at some locations told to only attend A&E if necessary.
The incident was still ongoing weeks later, according to an update on 5 December.
Because the hackers accessed systems via an online portal for appointments, the hospitals had to switch to paper-based operations.
In a report referencing the incident, the trust admitted all outpatient appointments were cancelled from 25 November when the attack began until 4 December, when services were reinstated
"The trust has been in a strong position with improving waiting times for elective, diagnostic and cancer pathways but this performance has been significantly impacted by the cyber attack that was experienced late November and into early December," noted the report.
The human impact of cyber attacks
The report noted that cancer diagnosis and treatment performance for October and November was positive. However, that fell in December, in part due to seasonal reduced capacity but also because of the impact of the cyber attack — and that would take months to catch up.
"The cyber incident was seen to impact elective performance both in terms of the loss of activity that would have provided treatment / diagnostic and stopped waiting times for patients, and on the ability to validate the waiting times position. Performance across RTT, cancer and diagnostics was affected,” the report added.
Despite the admitted delays to care, a Wirral University Teaching Hospital Trust spokesperson told DigitalHealth that staff had managed to maintain some services by implementing business continuity plans.
“Recovery plans were implemented immediately to proactively recover any lost activity, ensuring patients affected by the disruption are prioritized," the spokesperson told the publication.
"Our teams are focused on restoring performance across elective, diagnostic, and cancer pathways as quickly as possible, and we have already made significant progress."
Healthcare attacks are a growing problem
Research shows the healthcare sector is a major target for hackers, with organizations operating in the sector attacked four times as frequently as the global average for all industries.
RELATED WHITEPAPER
Indeed, the Merseyside attack is one of a long line of cyber incidents to impact British hospitals. Last year, NHS Dumfries and Galloway was hit by a data breach, while King's College Hospital Foundation Trust and Guy's and St Thomas' Hospitals Foundation Trust in London had to reduce operations after a cyber attack on provider Synnovis.
This incident led to at least two cases of severe patient harm, according to reports.
Trevor Dearing, director of critical infrastructure at Illumio, said at the time of the Merseyside incident in November that hospitals would continue to be targets, and needed to find ways to keep providing care to patients even when under attack.
"Cyber attacks aren’t going away, but hospitals must reach a point where patient care — urgent or routine — remains uninterrupted," he said.
MORE FROM ITPRO
- Why healthcare firms are a lucrative target for hackers
- Five ways threat actors target healthcare companies
- 190 million US citizens were impacted in the Change Healthcare breach
-
Post-cloud strategy: Architecting the next enterprise stackAs enterprises rethink their dependence on hyperscale, hybrid architectures are emerging as the new foundation for resilient, AI-ready infrastructure
-
Anthropic just launched Claude Fable 5, its first Mythos-class AI modelNews The launch of Claude Fable 5 marks the first public release of a Mythos-class AI model
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
