‘Basic IT security’ could have saved NHS from WannaCry attack, report says

The NHS could have avoided the ‘relatively unsophisticated’ WannaCry ransomware attack in May with ‘basic IT security’, according to a new report.

The National Unit Office (NAO) said that 19,500 medical appointments were cancelled, computers at 600 GP surgeries were locked and five hospitals had to divert ambulances elsewhere as a result of the ‘relatively unsophisticated attack’.

The NAO and the Department of Health was unable to cost the impact of the outbreak and the full extent of the damage may never be known.

Overall, 81 NHS organisations in England were affected - a third of the total.

NAO said the attack could have been prevented by basic IT practices. As early as 2014, the Department of Health and the Cabinet had written to NHS trusts, saying it was essential they had ‘robust plans’ to migrate from old software. In March and April 2017, NHS Digital issued critical alerts warning organisations to fix the exact bug in their Windows computers that later allowed WannaCry to quickly spread.

Before the attack, NHS Digital carried out an ‘on-site cybersecurity assessment’ at 88 out of the 236 health trusts inEngland. None passed.

Amya’s Morse, the head of the NAO, said: “The WannaCry cyber-attack had potentially serious implications for the NHS and its ability to provide care to patients.

“It was a relatively unsophisticated attack and could have been prevented by the NHS following basic IT security best practice. There are more sophisticated cyber-threats out there than WannaCry so the Department and the NHS need to get their act together to ensure the NHS is better protected against future attacks.”

Meg Hillier, chairwoman of the public accounts committee, said: “The NHS could have fended off this attack if it had taken simple steps to protect its computers and medical equipment. Instead, patients and NHS staff suffered widespread disruption, with thousands of appointments and operations cancelled.

“The NHS and the department need to get serious about cybersecurity or the next incident could be far worse.”