www.bbc.com Open in urlscan Pro
151.101.0.81  Public Scan

Form analysis
0 forms found in the DOM

Text Content

LET US KNOW YOU AGREE TO COOKIES

We use cookies to give you the best online experience. Please let us know if you
agree to all of these cookies.

Yes, I agree

No, take me to settings

BBC Homepage
 * Skip to content
 * Accessibility Help

 * Sign in


 * Home
 * News
 * Sport
 * Reel
 * Worklife
 * Travel
 * Future
 * More menu

More menu
Search BBC
 * Home
 * News
 * Sport
 * Reel
 * Worklife
 * Travel
 * Future
 * Culture
 * Music
 * TV
 * Weather
 * Sounds

Close menu
BBC News
Menu
 * Home
 * War in Ukraine
 * Coronavirus
 * Climate
 * Video
 * World
 * UK
 * Business
 * Tech
 * Science
 * Stories

More
 * Entertainment & Arts
 * Health
 * World News TV
 * In Pictures
 * Reality Check
 * Newsbeat
 * Long Reads

 * World
 * Africa
 * Asia
 * Australia
 * Europe
 * Latin America
 * Middle East
 * US & Canada


HSE CYBER-ATTACK: IRISH HEALTH SERVICE STILL RECOVERING MONTHS AFTER HACK

By Michael Sheils McNamee
BBC News NI

Published
5 September 2021

Share
close
Share page
Copy link
About sharing
Image source, Donna-Marie Cullen
Image caption,
Donna-Marie Cullen had come through months of gruelling treatment for brain
cancer when the cyber-attack happened

The first time Donna-Marie Cullen heard about a massive cyber-attack on
Ireland's health system, it was on the morning news.

The 36-year-old mother of two was waiting for her radiation treatment that
afternoon for sarcoma, a rare and aggressive form of brain cancer.

"I thought this is an awful situation for the HSE [the Irish health system] to
be in," she says.

"After that, I got a call at lunchtime and was told that my radiation wouldn't
be going ahead because of the cyber-attack.

"I didn't realise the severity, how invasive and how horrific this attack was."

On 14 May, when the attack occurred, Ms Cullen was nearing the final stages of
her treatment, having been diagnosed in September 2020.



"For the space of time when my radiation was paused, there was huge worry," she
recalls.

Ransomware attacks involve a criminal group using a form of malware to gain
entry to a system, encrypting important data and then demanding a payment in
return for decrypting it.

The attack in May was unprecedented in the history of the Irish state, affecting
almost every part of its healthcare system, already worn down by more than a
year of fighting Covid-19.

The BBC is not responsible for the content of external sites.View original tweet
on Twitter

Scrambling to deal with the situation, staff reverted to a paper system and the
number of appointments in some areas dropped by 80% in the days after the
attack.

For Ms Cullen, her radiation treatment looked set to be postponed as staff were
not able to enter the correct coordinates used with the machine for her
treatment.

She says it was only because St Luke's Radiation Oncology Centre at Dublin's St
James' Hospital had been able to separate its machinery from the wider system,
and consultants had spent the entire weekend rewriting coordinates, that it was
able to resume without a major delay.


Image source, Donna-Marie Cullen
Image caption,
Donna-Marie Cullen did not know if her sarcoma had the potential to return
quickly

But that period caused great worry for Ms Cullen.

"I knew the severity of sarcoma, I knew how fast sarcoma can grow," she says.

"They don't do stages of sarcoma. You either have sarcoma, or it has spread, and
if it has spread it is terminal.

"So for me it was the worry. If there was even a minute chance of a crumb of
this cancer left in my head, that it would just start to multiply and my
radiation plan would need to be completely revised."

Ms Cullen finished her cancer treatment in May.


'TARGETS WHICH HAVE MONEY'

Although it has been almost four months since the attack, the Health Service
Executive (HSE), Ireland's healthcare service, is still feeling the direct and
indirect effects.



A section of its website remains devoted to giving updates on services across
the country.

It notes that emergency departments remain very busy because of the hack, many
x-ray appointments remain cancelled and staff still do not have access to their
own emails.

The HSE says that more than 95% of all servers and devices have been restored.

"Acute services are almost fully restored, along with community and corporate,
with the remaining pieces to be finalised," it adds.

Dr Cormac Doherty, the cybersecurity programme manager at the Centre for
Cybersecurity and Cybercrime Investigation at University College Dublin, worked
as part of the state's response to the attack.

He says the Russian-based Conti ransomware group, which reportedly asked the
health service for $20m (£14m) to restore services, was behind the hack.

Mr Doherty says it chose to target a large organisation because of its ability
to pay a ransom.

"They look for organisations who are vulnerable and don't look after their
information security," he tells BBC News NI.

"If they [governments and organisations] are perceived to have the means to pay,
you can expect them to be targets in the future."

Image source, Getty Images
Image caption,
Ransomware attacks have become more prevalent in recent years

According to Mr Doherty, cyber extortion has a long history and in the past few
years ransomware attacks have become more common.

This year the Conti ransomware group has targeted the Scottish Environment
Protection Agency, and at about the same time that it attacked the Irish health
system it also encrypted a district health board in New Zealand.

The attack on the HSE came to an abrupt end after about a week of chaos when the
hackers handed over an encryption key reportedly for free.

Mr Doherty says that like any legitimate business, the group responsible for the
hack would have concerns about reputational damage and how it would affect its
ability to operate in the future.

"There is an entire economy, dark economy, that exists in parallel and along
with it ransomware operators.

"[Potential partners] could easily turn around to them and say: 'I can't believe
you encrypted a children's hospital, I'm not doing business with you'," he says.


'A DOUBLE WHAMMY WITH COVID'

Of the areas recovering from the cyber-attack, radiology is among the worst
affected, in part due to its reliance on computers.

Dr Peter Kavanagh, dean of the Faculty of Radiologists and Clinical Radiologists
at Connolly Hospital in Dublin, says it was hit with a "double whammy".

"There was the effect of Covid on radiology service provision, in addition to
the cyber attack which made many of the issues worse," he says.

When the attack first hit, radiologists sat next to the scanners they were using
and took down notes by hand.

While services have returned to about 90% capacity, issues persist.

"It [services] happens in a slower fashion. Each of the elements involved in
generating these images are subject to crashes and outages, which happen
sporadically," Dr Kavanagh says.

"Which means that patient throughput is slower than usual."

Image source, Thinkstock
Image caption,
Radiology services were among the hardest hit by the cyber attack

The provision of on-call services has been "particularly hazardous".

He says an on-call radiologist, looking at something which could be a clinical
emergency, would ordinarily be able to view a scan in their own home.

However, while that technology has been restored for many, some radiologists are
having to go through the process of driving into hospital numerous times over
the course of a weekend to provide on-call cover.

Dr Kavanagh says while solutions such as outsourcing patients to the private
sector could provide some relief, the fundamental, wider issue of understaffing
in radiology remains.


'IT WAS THE FIRST TIME I SAW FEAR IN HIM'

Ms Cullen says that throughout her treatment, she had tried to be as open as
possible with her 12-year-old son and had always remained "extremely positive".

"When the cyber-attack hit and we had no idea when we were going to get our
treatment back, it was probably the first time I saw fear in him, wondering if
this was going to grow back faster than the radiation is going to happen?"

She believes similar attacks could happen again.

Image source, Donna-Marie Cullen
Image caption,
Donna-Marie Cullen said she would not be surprised if similar attacks happened
in the future

"I don't think organisations take into consideration how easy it is to hack into
a system," she says.

"For me [the cyber-attack] was the lowest form of criminality, it was just a
disgusting thing to do and I have yet to see a more disgusting thing be done."


'RESTORING SAFELY'

The HSE says most of its priority systems are back online on local sites,
including radiology and diagnostic systems; maternity and infant care; patient
administration systems; chemotherapy; radiation oncology; radiotherapy and
laboratories.

It adds that over the past three years it has spent €300m (£257m) on capital
infrastructure, with €82m (£70m) specifically focused on "protecting the core
network from cyber entry".

An Garda Síochána (Irish police force) says it continues to investigate the
criminal ransomware attack with the assistance of Europol and Interpol.

It says it is also working with the cyber security industry, academia and other
law enforcement experts, including the FBI, Canadian Police, the UK's National
Crime Agency and the United States Secret Service.

Ireland's Department of Health, which was targeted in a similar attack a day
before the HSE attack, says the situation has "improved significantly since the
attack first occurred".

"Access to key ICT systems was fully restored within a short period, with
limited issues accessing niche or legacy systems currently being resolved," it
says.

A spokesperson for the Department of the Environment, Climate and
Communications, which is responsible for the National Cyber Security Centre,
said: "No ransom was paid either by or on behalf of the Irish government.

"The only contact with the group which claimed responsibility for this attack
was to serve them with the High Court order obtained by the HSE against the
release of stolen personal data.

"There has been no other direct or indirect contact with these cyber criminals."


MORE ON THIS STORY

 * Cyber criminals publish stolen Sepa data
   
   22 January 2021
   
   

 * Cyber attack 'most significant on Irish state'
   
   14 May 2021
   
   


RELATED TOPICS

 * Republic of Ireland
 * Radiology
 * Cyber-attacks
 * Cyber-security





TOP STORIES

 * Deadly gun attack at Russian school
   
   Published
   1 hour ago

 * Children flee school in Russia after gun attack. VideoChildren flee school in
   Russia after gun attack
   
   Published
   1 hour ago

 * Live. 
   
   Higher interest rate rises forecast after pound fell




FEATURES

 * People smuggler: I get clients to sign a waiver
   
   

 * Abe's funeral attracts world leaders - and protests
   
   

 * The far-right leader poised to run Italy
   
   
 * 

 * Peaky Blinders leaps from TV to dance stage show
   
   

 * Inside the world's most top secret museum
   
   

 * Family travel world before children go blind. VideoFamily travel world before
   children go blind
   
   

 * Japan's push into 'deep tech' innovation
   
   

 * Artist films Covid tests inside his mouth. VideoArtist films Covid tests
   inside his mouth
   
   

 * How 'average' and 'literally' lost their meanings. VideoHow 'average' and
   'literally' lost their meanings
   
   




ELSEWHERE ON THE BBC

 * Why Hollywood failed Generation Z
   
   

 * What's the right age to get a phone?
   
   

 * The number one soft skill to hone
   
   




MOST READ

 1.  1Deadly gun attack at Russian school
 2.  2Abe's funeral attracts world leaders - and protests
 3.  3India jackpot winner fed up with requests for help
 4.  4Far right wins in Italy and vows to govern for all
 5.  5Ex-surfer dies after punch outside Australian pub
 6.  6Pressure on Kwarteng as sterling slide continues
 7.  7Pound hits record low after tax cut plans
 8.  8Protests against draft in Russia's Dagestan region
 9.  9Rescue under way after Kenya building collapse
 10. 10People smuggler: I get clients to sign a waiver







BBC NEWS SERVICES

 * On your mobile
 * On smart speakers
 * Get news alerts
 * Contact BBC News

 * Home
 * News
 * Sport
 * Reel
 * Worklife
 * Travel
 * Future
 * Culture
 * Music
 * TV
 * Weather
 * Sounds

 * Terms of Use
 * About the BBC
 * Privacy Policy
 * Cookies
 * Accessibility Help
 * Parental Guidance
 * Contact the BBC
 * Get Personalised Newsletters
 * Why you can trust the BBC
 * Advertise with us
 * AdChoices / Do Not Sell My Info

© 2022 BBC. The BBC is not responsible for the content of external sites. Read
about our approach to external linking.