Cyberattack on the British Health System with Wanna Cry

We saw the United Kingdom’s National Health Service (NHS) racing against time to protect its IT systems from the unprecedented Wanna cry malware.

On 12 May 2017, hackers exploited a Microsoft operating system vulnerability and held NHS data hostage. When an NHS employee opened an innocent-looking email, Wanna cry activated in their systems, encrypted all data and blocked user activity. NHS doctors and nurses then stared helplessly at ransom messages. Users could access no files. The screen stated that unless payment reached the specified account within 3 days, the ransom would increase 2-fold; without payment within 7 days, files would never be accessible again.

An NHS employee describes the moment: “Before news spread, we realized something was wrong in the NHS. Before hospital systems sounded alarms, colleagues sent many messages about frozen computers. Rumors spread rapidly; nonessential operations were canceled, clinics reorganized and managers held special meetings. As in every crisis, confusion, bewilderment and speculation emerged.

Eventually, the news announced the attack had been stopped. Hospital and primary care center systems were affected, and the NHS electronically shut its systems down.

The rapid spread of smartphones and IT’s presence throughout life was enough to make us panic. Most NHS hospitals now use electronic notes, imaging systems and electronic prescribing. We might survive without a stethoscope , but without computer data that seems unlikely.”

Back to the Old Days

Many English hospitals announced that they had electronically protected systems before “Wanna cry” infected them.

However, this cyberattack’s impact appears truly tragic. In 3 days, Wannacry seized more than two hundred thousand computers worldwide. Because it damaged electronic patient records on every infected healthcare computer, staff returned to pen and paper. This further slowed a British health service already criticized for delays. The paperwork backlog also required extensive overtime to reenter records once systems returned to normal.

Some completely electronic NHS general practices, with no paper processes, could not admit patients. Many hospital services were also disrupted. A London general practitioner said: “It is not correct to say patients are not in danger, because even our most basic emergency need, X-ray imaging, is affected.”

At one of London’s largest hospitals, failure of control systems for blood-product refrigerators threatened surgical safety. London Hospital closed trauma, stroke and heart attack centers, forcing patients to travel farther and wait longer. Patients’ difficulties increased, bringing fear and sadness. One patient told the Financial Times: “I had waited 18 months for heart surgery. Everything was ready, but that day the consultant said their systems had been attacked and the operation was canceled: if blood were needed during surgery, they had no system to find a suitable match.”

The attack showed how vulnerable NHS IT systems were and how poorly the crisis was managed. Hundreds of thousands of NHS computers used 14-year-old Windows XP systems; Microsoft’s March security update had either not been installed in time or systems were too old to benefit from it.

Doctors capable of face transplants, bionic arms and even monitoring fetuses were left helpless by the attack, showing that computers are worth more than gold.

The NHS cyberattack provided many lessons. Healthcare policymakers, insurers and hospitals had been informed about threats and consequences but had not expected such damage, and had to confront it. This demonstrated the need to improve hospital IT systems. Until this attack in United Kingdom history, information security had not been an NHS priority.

What Is the Latest Situation with the Wanna Cry Attack?

Within 1 week of the attack, antivirus programs offered free software to protect computers. A young security programmer reportedly stopped its spread after spotting a flaw in the virus’s code. The irony is that a Windows coding flaw let it enter, while a flaw in its own code stopped it. This resembles targeted cancer treatments seeking weaknesses in cancer cells…

The attack genuinely affected many computers and users. Wanna cry apparently will infect no more computers, but other malware will certainly imitate it. Although this attack appears overcome, another could cause greater problems. Just as outdated medical supplies are unacceptable, the same should apply to IT products. .

Further Reading: How Did a Young Security Programmer Stop Wanna Cry?

The 22-year-old security programmer using the name MalwareTech said he was on leave, but began investigating at his computer after hearing of the spreading ransomware.

He said he accessed the code, found a “kill switch” and activated it: “It was partly luck. I had examined the application all night without sleeping. My discovery attracted intense attention. Because I spent my leave this way, my boss gave me another week off.”

The malware programmers called it wanacrypt0r 2.0 , and this ransomware tried to connect to a particular internet address whenever infecting a computer. MalwareTech noticed this long, random-letter address did not exist. He bought the domain for 10 dollars to track connections and identify how many computers and countries were affected, but unexpectedly triggered code that ended its spread.

A kill switch is code malware creators use to prevent spread if something goes wrong. Although MalwareTech’s discovery stopped spread, it does not solve the problem for already infected computers. Researchers predict future ransomware will lack this “kill switch” code.