NHS disability equipment provider on brink of collapse a year after cyberattack

A major supplier of healthcare equipment to the UK's National Health Service and local councils is on the verge of collapse 16 months after falling victim to cyber criminals. Private equity-backed NRS Healthcare works with around 40 councils across England and Northern Ireland, although most of its services are provided to …

[KittenHuffer]

If NRS does hit the wall ....

.... then Karma will only be satified if the scrotes that fubared their systems happen to be leaving hospital at around the same time, and find themselves bereft of the equipment that NRS would have supplied.

Thinking about it, I wonder if there is any way we could help Karma to be satisfied?!?

[Anonymous Coward]

Re: If NRS does hit the wall ....

Sounds like it needs taken into public ownership to maintain services whilst sorted out. Like Carillion was.

NHS England already run quasi-private ventures like its own in-house Bank/Locum agency NHS Professionals ….

[Pascal Monett]

Oh sure

"a pre-planned six-month digital transformation project being accelerated and delivered in just three weeks "

Okay, so either your initial planning was shit, or the results you got are shit, but you cannot tell me that a 6-month project was properly done in 3 weeks.

If that is indeed the case, you need to review your planning procedures, because they are shit.

[katrinab]

Re: Oh sure

I'm guessing they were about to do it anyway, over a planned controlled 6 month migration period, but given that the old system had been completely hosed anyway, they figured it would be reconstruct on the new one rather than the old?

[Paul Crawford]

Re: Oh sure

I doubt you could replace some legacy/insecure system with anything new in 3 weeks, that would only be enough time to restore from backups and do a bit of testing and training on not inviting Mr Cockup for dinner again.

[Empire of the Pussycat]

Re: Oh sure

Given that it included "...reimaging and/or replacement of over 1,000 laptops across the estate...", seems perfectly reasonable to spread that over 6 months to avoid disruption and reduce support volume.

But if everything is hosed anyway, there's opportunity to replace/upgrade much faster.

Unless you know their original plans, there's no rational basis for saying they were "shit".

[Phil Kingston]

Re: Oh sure

That's how I read it too. They were going to reimage everyone's laptops over 6 months. All nicely planned. Then, well, because everything was sub-optimal anyway, gather them all together, plug them all in at the unoccupied desks, start them imaging, dance like no one's watching around the office to whatever is high in the hit parade these days. Done. Home in time for tea and medals.

[Peter2]

Re: Oh sure

Okay, so either your initial planning was shit, or the results you got are shit, but you cannot tell me that a 6-month project was properly done in 3 weeks.

It's entirely possible to do a long project quickly.

If the 6 month project was based on training one user at a time and then moving them over to a new system, evaluating any issues and then moving the next user to avoid disruption then you could accelerate that simply by booking a single mass training course and accepting the downtime that they were suffering anyway with the 3 weeks being waiting that long for the training course slots to be available.

I've got a digitalisation project running at the moment which won't be finished until well into the next decade due to the approach taken being a budget conscious one of ensuring that we don't send any new paper documents to archives, and then destroy the old stuff as it reaches the destruction date. If we wanted to accelerate that radically then it's entirely possible given a large injection of cash; just pay for all of the old paper to be scanned.

[IGotOut]

Missing information in article

It's also worth pointing out they had multiple contracts with councils that were running at a loss, mainly due to rising costs.

"The company's accounts say it suffered a costly cyber attack last year and it is also understood to have been losing money on some of its contracts with councils."

https://www.bbc.co.uk/news/articles/cn72mpz0zzeo

[Fruit and Nutcase]

Private equity-backed

Do the rising costs include debt to the private equity backers?

[Dr Who]

Cyber Essentials Plus

Worth nothing that the British Library, which suffered a comprehensive cyberattack that took a huge amount of time and effort to recover from, were certified to Cyber Essentials Plus level.

To their credit they published a comprehensive post mortem of what happened, how they dealt with it, and the lessons they learned and want to pass on to others. It's a model of how organisations should respond in the event of a cyber incident. Anyone who takes this stuff seriously could do worse than than to read and inwardly digest the document.

https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf

[Annihilator]

"Government officials say they are monitoring the situation"

I'm sure everyone involved feels infinitely reassured

[Phil Kingston]

How do I get one of these "monitoring the situation" jobs? Sounds cushy

[Tron]

Perhaps not the cyberattack.

Were they on a path to going bust anyway, and the cyberattack just sped it up? Almost any company with a pile of debt would have had trouble coping with the post referendum inflation we have had. When your currency goes down 25% overnight, in a world where everything is priced in USD, the result is seismic. The government and media can cover it up, give it a fancy name - the cost of living crisis, and blame it all on Covid and Putin, but at the end of the day, the impact will still happen.

If you cannot secure your tech, go back to using people, phones and paper. You will be more resilient. We have been doing things this way for decades, and it generally worked. Shifting your reliance on to expensive tech (expensive because you have to keep updating it every few years to keep GAFA rich) is not always a good idea. Loads of small businesses use limited non-networked systems and paper for their day to day operations, with good reason.

[vtcodger]

Re: Perhaps not the cyberattack.

"Were they on the path to going bust anyway?"

That was my thought as I read the article. Sounds like their basic problem was that their operation was chronically(?) losing money thus leading to insolvency. The cyberattack was only an added aggravation? Seems to me that if they were even close to profitability the instinct of 98% of the managers in the world would be to blame the cyberknaves for all their problems and to promise to come back stronger than ever.

[wyatt]

Re: Perhaps not the cyberattack.

They're now in liquidation. It does sound as though they were struggling before the attack, it'll be interesting to see what their "PE" investors are owed. Lots of management fees will be registered knowing how they work.