London hospital vulnerabilities were known years before cyberattack

17 June 2024, 16:21 published

[ad_1]

Five London hospitals had to cancel operations and divert incoming ambulances as a result of a cyberattack against the Guy’s and St Thomas’ NHS Foundation Trust in June 2024

Since then, several hundred operations have been postponed or rescheduled, and the NHS has called for O negative blood donors to donate in a nation-wide push.

It has now emerged the hospitals affected knew about the vulnerabilities abused by the hackers for several years, documents reviewed by Bloomberg News have found.

Vulnerabilities known for years

According to the documents, which include publicly available information on board of director’s meetings, the Guy’s and St Thomas NHS Foundation Trust frequently failed to meet data security standards, with the board of directors questioning the risks posed to hospital IT systems and their third-party supply chain as recently as January 2024.

In the attack that took place at the beginning of June, the attackers struck Synnovis, the trust’s pathology services provider, forcing hospitals to rely on handwritten records and postpone a range of medical procedures.

In minutes taken from meetings, the board of directors pursued a number of IT modernization programs to increase the trusts’ cybersecurity capabilities, with a meetings in January this year commending that IT infrastructure across the trust was “configured to a good standard,” but concerns were continually raised about third party interfaces, including Synnovis.

The attack has been attributed to a Russian ransomware group identified as Qilin, who have emerged as a cross-sector ransomware threat since 2022. Hospitals are increasingly becoming a favorite target for ransowmare gangs thanks to their sensitive medical data and wide ranging third-party equipment providers, which provide a large attack surface.

Speaking on the attack, Mark Dollar, CEO of Synnovis said, “We take cybersecurity very seriously at Synnovis and have invested heavily in ensuring our IT arrangements are as safe as they possibly can be. This is a harsh reminder that this sort of attack can happen to anyone at any time and that, dispiritingly, the individuals behind it have no scruples about who their actions might affect.”