The UK’s largest NHS Trust was forced to take key IT systems offline on Friday following a cyber-attack, although ransomware has now been ruled out as the cause, contrary to early reports.
Barts Health, which covers five hospitals in East London serving 2.5 million people, was hit by the “IT attack” on Friday and subsequently took “a number of drives offline” as a precaution.
It added in a statement:
“Importantly, we can now rule out ransomware as the root cause. We have also established that in addition to the Trust’s core clinical system Cerner Millennium, Radiology and imaging from X-rays and scans continue to be used as normal. We have tried and tested contingency plans in place and are making every effort to ensure that patient care will not be affected.”
Despite these plans, the Trust’s pathology services were forced offline by the attack, according to reports.
They suggested Barts Health is still running the unsupported Windows XP operating system, which if true would put it at risk of cyber-attacks designed to exploit flaws for which Microsoft is no longer issuing patches.
A Freedom of Information Act request back in December revealed that 90% of NHS Trusts in England were still running the legacy OS.
Jamie Moles, security consultant at malware detection firm Lastline, argued that the NHS must invest in advanced security tools to spot and block such attacks, but is struggling with under-funding.
"There are a number of trusts in deficit and spending on the NHS has dropped in real terms since the recession. Priorities for all NHS trusts are unsurprisingly targeted at medical needs over and above admin and operational needs, but of course this includes IT security,” he added.
"While security remains a low priority for NHS management, they will increasingly fall victim to these kinds of threats, which wouldn’t be a serious problem except it has previously resulted in cancellation of treatments whilst the affected systems are investigated and cleaned up.”