Report reveals hackers got into ‘frail’ IT system two months before HSE took action

Report reveals hackers got into ‘frail’ IT system two months before HSE took action

Cyberhackers first accessed the “frail” HSE computer system as early as March 18 but despite alerts flagged about suspicious activity no action was taken until the gang demanded a ransom on May 14.

Although thousands of patients were affected when operations and procedures were cancelled around the country, it is believed no deaths were directly attributed to the crisis.

An external report into the devastating cyberattack shows the Russian-based Conti crime gang sent a malicious Excel file attached to a phishing email to a user at an ordinary patient workstation. Clicking on the file allowed the gang full access to the system, ultimately leading to “ accounts with high levels of privileges”.

Worryingly however the report states “several detections” of the gang’s activity were made during this eight-week period but they were not investigated. It states the gang were able to move with “relative ease” through the system using “well-known and simple attack techniques”.

It is understood that while the suspicious activity was noticed, it was not reported to the Gardaí or to the National Cyber Security Centre. An alert was sent just hours before the ransom demand referring to “unhandled threat events”. 

The report refers to a “low-level of cybersecurity maturity” across the system and describes the security as “frail” across numerous areas. 

Among the serious cyber-weaknesses highlighted in the report, carried out by PriceWaterhouseCooper were:

  • reliance was placed on a single antivirus which was not monitored or effectively maintained 
  • no security monitoring able to detect and respond to alerts 
  • a lack of effective updates or bug fixes across the IT estate 
  • no single person responsible for cybersecurity at senior level, described as “highly unusual” for an organisation of this size 
  • since 2018 the chief information officer has worked in an interim basis with “limited practical mandate, authority and resources” 
  • just 15 cybersecurity staff who “did not possess the expertise and experience” needed 

The report is critical in a number of places of the limited staffing numbers dedicated to such a sprawling computer network, and the lack of central leadership on this.

The network includes 4,000 locations with 4,891 services and 83,000 end-users operating across over 70,000 devices between hospitals, community services and external health providers linked to the HSE. The differences between these are highlighted in the report when it says that one hospital was able to “proactively prevent” the attack, as was the Department of Health. 

The HSE has previously said they allocated €100m between this year and next year to tackle the immediate problems.

The report indicates that a “multi-year technology transformation” is needed and makes a series of specific recommendations.

It refers to an upgrade of the imaging and radiology system NIMIS which was badly affected during the cyberattack leading to a significant impact on cancer patients. It is believed the HSE do not see that the reliance of this system on Windows 7 was a factor in the attack.

It is understood that the HSE is preparing a business plan to send to the Department of Health and request urgent changes to funding over the next number of years.

The service plan for 2022 includes operational expenditure of €43 million, and capital funding of €62million to be focus

Read More

No Comments Yet

Leave a Reply

Your email address will not be published.