Cyber attack delayed cancer treatment at NHS hospital

An NHS hospital has admitted its cancer treatment wait times increased in the wake of a cyber attack that took down its systems at the end of last year — and it will take many months to recover.

Last November, NHS hospitals and health centers that make up Wirral University Teaching Hospital Trust in Merseyside were hit by a major cybersecurity incident, with appointments cancelled and patients at some locations told to only attend A&E if necessary.

The incident was still ongoing weeks later, according to an update on 5 December.

Because the hackers accessed systems via an online portal for appointments, the hospitals had to switch to paper-based operations.

In a report referencing the incident, the trust admitted all outpatient appointments were cancelled from 25 November when the attack began until 4 December, when services were reinstated

"The trust has been in a strong position with improving waiting times for elective, diagnostic and cancer pathways but this performance has been significantly impacted by the cyber attack that was experienced late November and into early December," noted the report.

The human impact of cyber attacks

The report noted that cancer diagnosis and treatment performance for October and November was positive. However, that fell in December, in part due to seasonal reduced capacity but also because of the impact of the cyber attack — and that would take months to catch up.

"The cyber incident was seen to impact elective performance both in terms of the loss of activity that would have provided treatment / diagnostic and stopped waiting times for patients, and on the ability to validate the waiting times position. Performance across RTT, cancer and diagnostics was affected,” the report added.

Despite the admitted delays to care, a Wirral University Teaching Hospital Trust spokesperson told DigitalHealth that staff had managed to maintain some services by implementing business continuity plans.

“Recovery plans were implemented immediately to proactively recover any lost activity, ensuring patients affected by the disruption are prioritized," the spokesperson told the publication.

"Our teams are focused on restoring performance across elective, diagnostic, and cancer pathways as quickly as possible, and we have already made significant progress."

Healthcare attacks are a growing problem

Research shows the healthcare sector is a major target for hackers, with organizations operating in the sector attacked four times as frequently as the global average for all industries.

Indeed, the Merseyside attack is one of a long line of cyber incidents to impact British hospitals. Last year, NHS Dumfries and Galloway was hit by a data breach, while King's College Hospital Foundation Trust and Guy's and St Thomas' Hospitals Foundation Trust in London had to reduce operations after a cyber attack on provider Synnovis.

This incident led to at least two cases of severe patient harm, according to reports.

Trevor Dearing, director of critical infrastructure at Illumio, said at the time of the Merseyside incident in November that hospitals would continue to be targets, and needed to find ways to keep providing care to patients even when under attack.

"Cyber attacks aren’t going away, but hospitals must reach a point where patient care — urgent or routine — remains uninterrupted," he said.

MORE FROM ITPRO

• Why healthcare firms are a lucrative target for hackers
• Five ways threat actors target healthcare companies
• 190 million US citizens were impacted in the Change Healthcare breach