Another 'major cyber incident' at a UK hospital, outpatients asked to stay away

A UK hospital is declaring a "major incident," cancelling all outpatient appointments due to "cybersecurity reasons." The Wirral University Teaching Hospital NHS Trust, located in North West England, said the so-called "incident" affects the whole Trust, which oversees Wirral Women and Children's Hospital, Clatterbridge …

[0laf]

Get your incident bingo cards ready.

Although having worked with some of the NHS IT guys in the past I have a lot of sympathy. The run a biblically complex group of organisations (NHS isn't one one big organisation it's many interlinked entities), with biblically complex data and IT needs, run on pennies, with overworked under paid employees who are fighting a combination of cutbacks with a manglement and staff base that have little to no interest in anything outside of their needs as clinicians or political pole climbers.

These incidents are unfortunately inevitable and likely to continue. There may also be a nation state element to the attacks.

[Korev]

> There may also be a nation state element to the attacks.

Now don't Russia to conclusions...

[Trigonoceps occipitalis]

No, Put in the boot now.

[Anonymous Coward]

And the consultant for the eye hospital over from our support site that smashed up an expensive touchscreen computer because it was getting on his nerves.

The trust being large that it had TWO IT teams doing things seperately as that's what the Trust wanted. Giving us little access when rolling out new kit so having to sit at a nurses station for 20mins waiting for 3rd line to get out of their fucking meeting so I could install the blood printer (prints the labels that go round your wrist).

Then, which still pisses me off to this day, the IT managers daughter got a job because of who her dad was. Asked us to sort out some xray type machine (can't remember what it was. Was a PC but something to do with xrays) because "All the other engineers have gone home and you guys are the only ones left" (it was a Friday, we were contractors and all of IT had left early). We asked for the ticket which we kept being told we MUST GET A TICKET but she had none and cause of her dad, didn't need one.

So we go over the road, none of our cards let us in that fucking building. She's eventually made to come over to let us in, oh look her card doesn't work either. Jesus christ. We get in, find the nurses who tell us "IT was here earlier but they only took the keyboard and mouse". So essentially IT were being fucking lazy so made us move the bulky kit. Stuck it on a trolley and had to push it up the steep hill to the main building. We get to where we were told it was going, the guy has no idea what its about. Eventually someone arrives that knows about it and we then have to carry it up some windy stairs.

IT at the NHS is normally a shit show. I was first there in 2007. Left and back again in 2017. The IT culture hadn't changed! They were still quite cuntish. Having said that, still, if desperate, is a good place to start and get experience instead of working for the MSP sweatshops.

[Anonymous Coward]

"The only thing necessary for the triumph of evil is for good men to do nothing." -- Edmund Burke ...

Edmund Burke served as a member of Parliament between 1766 and 1794 so what has changed since then?

[Anonymous Coward]

Oh yeah, I've worked in various bits of the NHS, theajority of them are decent, dedicated people but there's always an utter wanker or two who gets in your way because they're important doncha know.

I rescued one IT team who'd moved and fucked up their own storage array by connecting it up wrong and overwriting the storage controller config when it asked them to accept or reject the metadata from a foreign disk set.

Got asked by the IT manager to interview after that debacle only to be told they wouldn't employ me because no IT degree so wasn't considered qualified or capable enough.

[hoola]

Not just the NHS, this scenario is absolutely everyone, Public & Private sector.

[Anonymous Coward]

Sounds about right. No doubt they had someone already lined up internally and wanted to give him/her the role and was forced by HR to put the job out to the public. Only to fob everyone off that applied with bullshit reasons why they didn't get it.

Yes I saw that happen at our place. Wasted everyones time.

Same with role I applied for a few years back. I'd been doing it for 7 years then left. Decided would go back as paying more so I applied for the old role I had been doing. Was only two of us that applied. Got rejected as wasn't experienced enough. The idiot they employed only lasted a year due to being out of his depth and them giving no training. Turns out he was a mate of the fuck whit that interviewed me.

[Mrs Spartacus]

The envy of some parts of the third world..

Please only turn up if you're actually dead. We don't want to burden the wonderful NHS...

Having done a very small project for the NHS, I pitty the guys trying to sort out any issue, it's all a mess.

[Stuart Castle]

Back in the 90s, I worked in our local hospitall. It was a 600 bed hospital spread over several buildings in a site that occupied a huge area. I don't know how many staff they had, but it was a lot, and most staff had at least one computer in their dept. As it was the early 90s, computers were nowhere near as rife as they are now, but they still had a lot of computers, potentially hundreds.

Although my job was invoice processing rather than anything specifically IT related, I ended up doing support on a voluntary basis because our IT staff consisted of 3 people...

[Mike 137]

Whether or not ...

"There may also be a nation state element to the attacks"

Regardless of this, it'd be interesting to discover whether these hospitals were targeted, or were merely so darned wide open they fell victim as collateral damage to a shotgun attack aimed at some third party (as in the case of notPetya). Having tried to do infosec in an NHS trust, I suspect the latter is most likely.

[0laf]

Re: Whether or not ...

Bit of both probably

[Sir Sham Cad]

Re: Whether or not ...

We know that Healthcare is being targeted by Nation States. The main issues in critical infrastructure/services is that you don't get downtime to patch the huge IT infrastructure estate (even though NHS England require resolution in 14 days or SIRO risk signoff) so can remain vulnerable for months.

Anything InfoSec: they need to get lucky once, we need to get lucky all the time.

[elsergiovolador]

Mouse take

This is another even dance that introduction of com-poo-ters to NHS was a mouse take.

If we still used paper records, none of this would have happened.

[Anonymous Coward]

Re: Mouse take

they still use paper.

My old man is in a hospice and the the staff there were doing double entry, once on paper and once in the system.

[Mrs Spartacus]

Re: Mouse take

Sounds like a sensible real-time backup system...

[Ochib]

Re: Mouse take

Wife works at a care home and most of the Staff are not IT literate. For example

The cash system is an excel spreadsheet that they use a calculator to add up the rows and columns and have problems getting the figures to add up correctly. This document is then printed out and faxed to head office.

[MachDiamond]

Re: Mouse take

"This document is then printed out and faxed to head office."

For some things, that's not a bad idea. It would possibly mean there isn't any way for that computer to connect to the internet. Could be stupid people as well, but benefit of the doubt and all that.

In a world with bazillions of simple accounting apps, why would somebody use a Borkzilla spreadsheet for that?

[Sir Sham Cad]

Re: paper records

Aside from anything else, there are IT systems required for tracking paper records. Yep. I know.

Almost 20 years ago I remember seeing paper records strewn all over the place as a building that was sold off to be turned into flats was just abandoned. I was just there to pull out the network kit. I hope to FSM that those records had been digitised first but I have my doubts.

[0laf]

Re: paper records

Happens with surprising regularity. I've been involved in a number of incidents over the years where council buildings have been mothballed and later when they go on sale or get reinstated someone finds literal tons of highly confidential data either just lying around or still in filing cabinets in those buildings.

[MachDiamond]

Re: paper records

"I hope to FSM that those records had been digitised first but I have my doubts."

Bloody Pastafarians again!

[MisterHappy]

Who 'Owns' IT?

It would be interesting to see if the IT dept have their own director or if they are under Finance.

In my experience, IT running under finance = spit & bailing wire.

[Anonymous Coward]

Re: Who 'Owns' IT?

Equally awful is when Estates and Facilities try and do it.

At least an accountant knows what a PC is!

[Doctor Syntax]

Re: Who 'Owns' IT?

At least an accountant knows what a PC's book value is

FTFY

[Flywheel]

Re: Who 'Owns' IT?

A PC is a high-cost liability that needs to be purchased for an inflated price and written off at a loss before the next Windows update comes out.

[Dante Alighieri]

Re: Who 'Owns' IT?

The "About us" does not list a Director or IT. Nor does it make clear which of the Execs is responsible. Many summaries skirt around the edges of systems.

In my local NHS trust there is a board level director of IT, who is not the director of finance, nor estates.

[0laf]

Re: Who 'Owns' IT?

I think it's often pretty random in the public sector. Depends on which senior manager has moved on. It's normal practice now to crash two departments together to save on that senior manager's salary.

[Anonymous Coward]

Re: Who 'Owns' IT?

Ours had a specific IT CEO, the the IT director who was bent as fuck. Told everyone who was on a band 5 (2nd/3rd) engineers at the time they can be replaced with "box monkeys".

To be blunt he was a cunt.

Not forgetting the bribe they took from HP to sign up to the HP contract for laptops.

[Doctor Syntax]

Advised out-patient procedure

1. Print out next days appointments at end of day and make sure everyone who needs one has a copy

2. Ensure the fax machines are working, connected and loaded with paper.

3. Just in case, have a few manual typewriters.

[Mrs Spartacus]

Re: Advised out-patient procedure

As long as these "type writers" of which you speak can bluetooth to a phone, otherwise people won't know what to do with them....

[Winkypop]

Relax

We have always been at war with Eastasia

[Don Bannister]

Seems a bit contradictory

Our business continuity processes are in place ....

All outpatient appointments scheduled today are canceled ....

[Ian Johnston]

Re: Seems a bit contradictory

No contradiction. The business continues by not seeing patients, who only clutter up the place anyway.

[Anonymous Coward]

I wonder is the NHS receiving special attention, one assumes from adversarial states, because I can't see there will be any money in it or is this down to incompetent management who prefer to spend money on Diversity Managers and rainbow crossings in the already extremely diverse organisation?

Assuming foreign states it's only going to get worse and perhaps preferable to kinetic retaliation to Biden and Starmer's recent escalation. Although, I think kinetic retaliation will happen unless Trump can persuade Putin to just take it until he gets into office and negotiates peace. But ... the neocons will try and take it beyond that possibility in the next month or somehow block or kill him, they are so dead set on their arms profits and destruction of the current order they risk their own annihilation.

[hoola]

The issue is that the public (the younger ones) are obsessed with everything being online, app based blah blah. This immediately opens up the attack vectors to the outside world.

This scenario is pushed by the numpties that are in their 40s & 50s that are also bought into this shite. Yes, it can be more convenient but does it save money?

The answer is highly unlikely but hey, I have an App where I can login from a crap mobile device and do "Stuff",

Now add in the next wave of idiocy, making all patient records available to the patient online. If that is not a fat target with a big arrow in the middle I don't know what is.

Currently if you put in a FOIA ( or more correctly DSAR) for you patient records you will get it on a CD, merged into a PDF that is protected.

All that will become available behind whatever crappy security people have with passwords and possible MFA, on the same device.

I also question the value of this data to most. The crucial part in this is that the data is available to all NHS trusts internally so that if you rock up at A&E outside of your area, history is available.

I requested this information because I had a consultant radiologist friend and we wanted to review a CT scan. It came on it's own CD with an application to replay the scan protected by a password.

To most people 99% of the information is useless. To me this just appears to be an an obsession with stuff being online with no concept of the actual use cases.

[Anonymous Coward]

> Now add in the next wave of idiocy, making all patient records available to the patient online. If that is not a fat target with a big arrow in the middle I don't know what is.

Indeed, and there's no way to opt-out of your own records being (theoretically) available online. So the day that a security incident occurs with the system that provides access to those records then it is likely to affect both those who *do* want their records online and also those who *do not* want their records online.

> Currently if you put in a FOIA ( or more correctly DSAR) for you patient records you will get it on a CD, merged into a PDF that is protected.

A couple of years ago I obtained copies of information relating to my health records from a "central" Health Service agency. They provided this special category personal data via 2 encrypted ZIP files as email attachments and the email indicated the telephone number to call for the decryption password.

However the encryption used was the original/defacto ZIPCRYPTO "home grown" encryption from the 1980s, not the more recent PKWARE encryption (which many ZIP apps don't support) that is based on AES. ZIPCRYPTO has been know to be useless since the 1990s, no-one should be using it in this day and age, it can be easily bruteforced.

When I phoned the provided number with my Caller ID withheld they only asked 3 items of information (ALL of which were present in the email so anyone intercepting it had what they needed) before providing the password. Additionally the decryption password turned out to be only 8 characters long consisting of a 7-character local placename and the number "1". There's opensource/free software out there to bruteforce such encrypted ZIP files.

As part of a data protection complaint case I opened with the ICO against this organisation one aspect of my complaint was that they provided special category personal data insecurely via email by using a "prehistoric" form of encryption which was no better than using no encryption at all. I even included with my complaint a copy of a 1990s research paper "A Known Plaintext Attack on the PKZIP Stream Cipher" which clearly stated that this encryption was considered back then to be "weak" yet more than 20 years later this org was still using it. Unfortunately, like the majority of my Complaint, the ICO ignored this aspect of my complaint.

I expect this Health Service organisation is still using ZIPCRYPTO "protected" files to send personal data to individuals.

[MachDiamond]

"The answer is highly unlikely but hey, I have an App where I can login from a crap mobile device and do "Stuff","

Well, if you weren't too drunk at that seminar put on by the app's publisher, "Stuff" is very important and being able to get it done from a tropical beach in the Caribbean is so much better than getting it done while in the office. The bonus is that having gone that route a few times and being hacked on numerous occasions means you have a lifetime of free credit monitoring (a short life if you keep getting blasted at vendor sales functions).

[nobody who matters]

"Biden and Starmer's recent escalation" as you put was no such thing. It was a response to the major escalation by Russia of widening the scope of the war by deploying the soldiers of a previously uninvolved country within the war zone. Even as an action to level-up the playing field, it still leaves Ukraine on a lower level than Russia.

Whilst I risk censure for going off-topic, you cannot be allowed to get away with making such misleading sweeping statements.

[Steve Jackson]

American spellcheck if at all

At least the appointments weren't cancelled.

[barryc]

IT incompetence in NHS

Reading these reports several points come to mind:

Who (people) administers the Routers and Firewalls?

How can a cyber attack steal millions of documents ?

If NHS spent just a few pounds on Real IT professionals.

An IT degree doesn't count - any idiot can get one of those.

The usual Public sector response of "oh Dear, lets stop work" is a crazy dereliction of duty.

[Anonymous Coward]

Re: IT incompetence in NHS

The usual Public sector response...

I think you'll actually find that in hospitals, the usual response is to carry on work with whatever is available to allow that work to happen, not to down tools and go for a cuppa.

[steviebuk]

Re: IT incompetence in NHS

You've clearly never worked in NHS IT

[Anonymous Coward]

Re: IT incompetence in NHS

> Who (people) administers the Routers and Firewalls?

I do, actually.

At least in one of the Ambulance Trusts that has a few rooms full of people handling 999 calls from members of the public and dispatching vehicles to assist them, etc

As other posters have mentioned, unfortunately the NHS is massive and varied.

MY OWN little section of it has multiple effective layers of security (physical clustered firewalls, software firewalls, internal segmentation between the control room systems and corporate, isolated VLANs, immutable backups replicated off-site, various endpoint protection + anti ransomware + vulnerability scanners, sandboxed remote desktop with MFA for remote access instead of VPNs, etc etc etc) and a pretty knowledgeable (if horrendously understaffed and underpaid) internal IT team to support it all.

But even with all that we're constantly fighting an uphill battle against the powers that be whenever it comes to the latest shiny (what do you mean I can't access DropBox or ChatGPT on my work computer?) and whilst we do run regular phishing exercises there is very little actual effort put into regular staff training and awareness (the less said about the proportion of staff who actually complete their supposedly mandatory annual cybersec e-learning the better).

We're also getting absolutely crippled by red tape and audits. It's a rare week when I don't have to spend at least half of my time putting a fresh set of evidence together, rewording a process/policy document or writing a business case instead of actually investigating and fixing faults or making the existing technical setup more bulletproof.

However we're still in a very good place compared to most of the various smaller sub organisations who just offload their IT on the central hubs. And plenty of hospital medical tech is ancient and will still only talk to old embedded XP kit etc. Supplier supply chain issues are also rife (in last 6 months alone we'd two key suppliers that couldn't connect in to support their on prem systems because some aspect of their cloudy internet guff had been compromised, and our immediate response is to blanket block the entire supplier + if the system REALLY needs support then one of our own techs can setup a supervised screen sharing session).

The central NHS email system is constantly seeing account compromises (shocker, MS 365 with no enforced MFA?) and all the mainland UK NHS organisations are interconnected via the NHS "N3" WAN (with pipes to offshore and Northern Ireland too), so there's an argument to be made that we're really only as safe as the worst trust. Thankfully a lot of trusts (ours included) treat intertrust traffic as potentially suspect and block/screen most of it. Even long before Wannacry we'd cordoned ourselves off from the regional network as much as possible.

It's not all gloom though, I've been in post for over 15 years at this point and things have definitely improved - more knowledge sharing, more investment in preventative tech, more holding suppliers to account for security in their contracts, etc. There is also currently a big push to get contingency arrangements in place for supplier chain attacks - (eg. if your new payroll or staff rostering system is cloud hosted then you must be prepared to lose connectivity to it for months at a time in case the supplier gets hacked and we knee jerk reaction block them). But unfortunately staffing levels and pay are simply in the toilet. My own team is at a quarter capacity and yet we simply cannot hire qualified or even smart+keen people (outside of students and apprenticeship programs) because they know they can work elsewhere for double the pay and less hassle.

[MachDiamond]

Re: IT incompetence in NHS

"It's not all gloom though, I've been in post for over 15 years at this point and things have definitely improved - more knowledge sharing, more investment in preventative tech, more holding suppliers to account for security in their contracts, etc."

Some improvements in system architecture might be helpful as well. If somebody in housekeeping can click on an email link and bring down the entire hospital, there's an issue. Keeping humans in the loop might be important as well. Why does the hospital director need unfettered access to the hospital's central computing system from anywhere in the world? It would be better to have some sort of gatekeeping. The same goes for anybody that IS cleared for research on NHS data. If it's that important to them, they should be able to visit an approved location and login via a VPN and not be able to download sheaf's of data as they like. It's the "convenience" problem where people are demanding that things be easy which often comes at the cost of security. I'm not saying that a nursing station on a ward has to jump through all sorts of hoops to find the medication schedule for a patient. They shouldn't be able to do that from that computer for the entirety of the patients everywhere in the hospital and through the ages.

[Mark Fenton]

NHS Best in the world

...or so we keep being told.

Sorry, I should have phrased the NHS (pbui)

[Tron]

Business as usual.

Stay away from hospitals because of Covid. Stay away from hospitals because of staff shortages - we sent them home at Brexit. Stay away from hospitals because of strikes. Stay away from hospitals because of the backlog.

Now its hacks.

Just get painkillers and get on with life. We all have to go some time. Given what lies ahead, you won't be missing much.

The bounceback time from malware in the UK is terrible, suggesting they have toss all in the way of back ups or access to replacement kit. And just can't do the basics of airgapping important networks from the public internet.

Are we sure this isn't Microsoft's latest attempt to 'nudge' people on to W11, everything else having failed?

[Anonymous Coward]

Re: Business as usual.

In a good health care system, you'd stay away from hospitals because first line care (GP, pharmacist, carers) catch things before they become debilitating nightmares.

But for reasons I've yet to discover most healthcare systems across nations that used to have great ones, seem to be in decline, with some offering more resistance than others.

It is not just the UK.

Why is it when technology supposedly improves, when education and science improve, that the health care system goes in reverse?

[MachDiamond]

Re: Business as usual.

"Just get painkillers and get on with life."

For those, you must go through a very thorough process to see if you shall be able to have them. Anticipate a 6 week lead time for anything more potent than aspirin.

To get my blood pressure medication, I have to go hat in hand to the doctor for a renewal of my prescription. The cost of the visit is more money than the meds and it's not the sort of thing that gets abused. The first dose was too high and made me feel like shit, but that's not the sort of thing that gets meds abused. I don't get migranes like I used to, but the cost of going to a specialist who looks at my file and asks two or three questions before giving me another prescription for the really expensive stuff that works (and isn't covered) made the whole escapade a financial burden. It's another drug that isn't something you'd take for fun. It's faster and cheaper to get pain killers more informally except you may not get what you ordered which can be problematic.

[midgepad]

Bad software

Doesn't help doing medicine.

Good software can.

Who buys the good stuff...

[Anonymous Coward]

To me this reads like repeated terrorist attacks, something the UK has ways of solving in its history.

Imagine a political activist or criminal walks in a hospital and causes the equivalent amount of damage.

Would you not see an armed response and several ghostly agencies involved to have quiet words in dark corners to prevent future attacks?

So why not for digital attacks?

[IceC0ld]

I've worked for several years at most of the major hospitals in my region, inc the two mentioned here :o(

and the teams there work wonders keeping it all up in the air

the main problems are as stated elsewhere in the thread that no one has a handle on both the set up AND the budget

so the CIO / CTO hear about issues that could arise, and the guys that are actually at the rock face, the IT boss, director is too grand a term, and manager doesn't cut it either

so said issues COULD be an issue, but I never seen any instance of where it would filter down, so the team could be made aware, and said team could possibly have had input, I mean, god forbid the peons get involved in anything to esoteric as decisions ffs :o)

not saying that streamlining and removing said CIO / CTO's would help / work, but wouldn't hurt :oP

did work one, smaller hospital, world renowned brain surgeons etc, the IT team there WERE controlled by the one guy, who DID have his hand on the pulse, if not the budget, at least he was privy to what we had left :o)

and he managed to ensure the perm guys were all fully aware, and cyber sec clued up

we still had issues, but nothing as major as this

also, I 'thought' there was a moratorium on attacking health infrastructures ?

but has that all gone now ?

FWIW, IMHO NHS attacks are not just about fiscal rewards, I believe they are being used to test out attacks, so the lower ranks, as it were, can have a go, and be watched to see how they progress, the bite back from a trust is comparatively toothless compared to say, going after anything financial / military ?

hoping the guys get the wheels back on their truck quickly though, as the next round is surely coming :o(

[Anonymous Coward]

also, I 'thought' there was a moratorium on attacking health infrastructures ?

Some groups do, can't imagine certain state actors care though. They aren't exactly people known for their morals.

[nobody who matters]

No moratorium is going to prevent the collateral damage from scattergun attacks. The 'Bad Actors' as politicians seem fond of calling them, may not have deliberately targetted a particular sector or organisation, but their malware gets inadvertantly passed on via various other routes.

Unintended consequences as a result.