The opening of a malicious Microsoft Excel file attached to a phishing email led to the cyber attack that crippled the national health service earlier this year, according to a report on the incident published on Friday.
The file was opened at a HSE workstation on March 18th, with the email having been sent to the "patient zero workstation" two days earlier.
Over the coming eight weeks, a number of “alerts” were raised within the health service that the IT system might be compromised, but the significance of the alerts was not identified at the time.
The ransomware that was introduced into the system was “detonated” on May 14th, leading to an immediate crisis across the health service.
At a press briefing prior to the publication of the report, HSE chief executive Paul Reid said a high proportion of the organisations that are subjected to a cyber attack are "re-hit" and that actions have and are being taken to mitigate the risk to the service.
The response to the alerts that were raised did not involve the response that should have occurred, he said.
The Department of Health, and an unidentified hospital, took steps prior to May 14th that mitigated the effect of the attack on their systems, the briefing was told.
‘Frail’ IT system
The report, commissioned by the HSE from PwC, identified the “frail” nature of the dispersed IT system used by the health service as a key weakness and recommends a multi-year programme of investment in IT and cybersecurity.
There was a “known low level of cybersecurity maturity” within the HSE and the connected national health network, and this weakness had “persisted”, the report said.
An extra €100 million is to be spent on this issue next year, Mr Reid said, and a business case for an as-yet-uncosted multi-year investment programme is being worked on.
A subcommittee of the HSE board should be set up and should ensure requests for funding to the Government for an IT upgrade “are clearly articulated and the risks associated with the lack of investment are communicated and understood,” the report said.
The report is to be shared with other State and non-State organisations to inform their future preparedness against cybercrime, which is “increasing in frequency, magnitude and sophistication, with cybercriminals operating across jurisdictions and country borders”.
Ransom
The report does not deal with the issues of a ransom or the location of the criminals behind the attack, but the Government said at the time no ransom would be paid, and a number of observers have said the criminal gang responsible is mostly likely based in Russia.
The report noted the staff in the health service showed “dedication and effort” in response to the crisis with individuals across the HSE and elsewhere in the health system responding in a way that illustrated they are “resilient, respond quickly, and have an ability to implement actions and workarounds” in times of emergency.
It noted the HSE is the largest employer in the State and uses more than 70,000 devices, such as personal computers and laptops.
When the Conti ransomware attack was launched early on Friday, May 14th, it resulted in healthcare professionals losing access to all HSE-provided IT systems.
“Healthcare services across the country were severely disrupted with real and immediate consequences for the thousands of people who require health services every day.”
At the press briefing Mr Reid said there was no indication that any patient had died as a result of the cyber attack, and that “great credit” was due to those in the health service for the way they had responded.
The report details how cybercriminals have been targeting healthcare providers and healthcare organisations in the United States, Australia and New Zealand, though Ireland was the first jurisdiction to suffer an attack on its national health service.
Last month much of the provincial healthcare system in Newfoundland was attacked.
The report said it appeared that the criminals used “relatively well-known techniques and software to execute their attack”.
Personal data
The report details how once the criminals had gained access to the health service system, they compromised and abused a significant number of accounts with high levels of privileges, compromised a significant number of servers, exfiltrated data, and moved their operation to statutory and voluntary hospitals.
At the press briefing, the HSE's interim chief information officer, Fran Thompson, said the normal and the "dark" web were being monitored to ensure people's data was not published.
The seriousness of the attack on the health service could have been greater, the report noted, “if there had been an intent by the attacker to target specific devices within the HSE environment, eg medical devices”; if the criminals had tried to destroy data at scale; or if they had interfered with the system used by the Covid-19 vaccination scheme.
It is likely that the time it took to recover from the attack would have been “considerably longer” if the criminals had not, on May 20th, posted a link to a key that decrypted files encrypted by the Conti ransomware.
The report noted the areas of the health service that were best equipped to maintain clinical services during the prolonged IT outage were those that rely on paper records for patient services.
It said the seriousness of the deficiencies in the health network system persist and require “transformational change”.
It is clear that very significant investment “on an immediate and sustained basis” will be required to improve the HSE’s IT system and its security.
Improving the system – which “evolved” rather than having been designed, and which involves a cybersecurity risk that is common to all organisations connected to the national health network – will be a “complex programme”, the report said.
The vulnerabilities that are highlighted in the report are not unique to the HSE, the PwC report said, and all organisations therefore need to consider the extent to which they are protected from a major cyber incident.
“The HSE, the State, and non-State organisations, now have an opportunity to build a more robust and resilient cyber frontier nationally.”
