WannaCry cyber-attack cost NHS £6 million

A new analysis from Imperial College London has revealed the true cost of the 2017 WannaCry cyber-attack on NHS hospitals in England to be almost £6 million.

WannaCry was a global ransomware attack that took hold across multiple continents and organisations on 12 May 2017, locking users out of infected computers and holding their data for ransom. The NHS was among those hit by the attack, with more than 600 NHS organisations affected, including 34 directly affected hospitals.

Although the virus was thwarted within just 12 hours, hospitals directly affected by the computer virus had to cancel 13,500 outpatient appointments, including 139 for patients with suspected cancer, amounting to millions lost through reduced activity and potentially delaying critical care.

Until now, only estimates have been made about the cost of the cyber attack on the NHS. But now, the Nature Digital Medicine journal has concluded that WannaCry caused hospitals in England to lose £5.9 million. There remains no way to measure how such events could cause harm to patients and affect their safety.

Professor the Lord Ara Darzi, study author, said: “This analysis demonstrates the devastation to health systems that cyber-attacks can cause, and yet these figures still do not paint the full picture of the impact on care delivered. As health systems are becoming increasingly dependent on digital, we need a greater understanding of the full impact that cyber-attacks, or indeed any IT failure, can have on patient safety to better prepare us for the inevitability of future attacks.”