Resolving WannaCry with Barts Health NHS Trust
On Friday 12th May 2017, at approximately 1 pm, organisations and Trusts across the NHS were hit by a ransomware attack that would become infamously known as WannaCry. The cyber attack was unprecedented, affecting more than 300,000 devices across 150 countries – and many high-profile organisations, including the NHS.
Don’t be fooled by the whimsical name; this crypto worm was no laughing matter. The cyber attack caused severe disruption to critical health and care services at more than 50 NHS Trusts and GP surgeries. Ambulances had to divert from affected sites and patient appointments were cancelled up and down the country.
A Potentially Deadly Cyber Virus
By nature, ransomware restricts access to any computer, device, or network that becomes infected and then threatens to delete data unless a ransom demand is met. In this instance, WannaCry exploited a vulnerability in Microsoft’s Service Message Block (SMB) protocol and spread through internal networks like a virus, attaching itself to devices throughout the NHS and encrypting files on a variety of MS operating systems. Once encrypted, the WannaCry software demanded a Bitcoin cryptocurrency payment of either $300 or $600 in order to restore the data, without any guarantee that this would be fulfilled.
Barts Health NHS Trust was one the affected Trusts and needed to rapidly implement emergency measures as its systems became infected with the ransomware. The critical nature of the health and care services delivered by Barts, including operating East London’s major trauma centre and other essential services such as pathology, caused a knock-on effect to connected NHS organisations outside of Barts’ own five hospitals.
The cyber attack was proving to be life threatening and immediate action was needed.
Acting fast to limit the impact
Once alerted to the attack, the Barts ICT team acted swiftly to manage the impact and limit critical data encryption. In less than 30 minutes, most of the Trust’s critical servers, services, and networks and had been disconnected from one and other to prevent further spread of the malicious software. This action ensured that a relatively low number of IT systems had been affected, by comparison with the attack’s potential impact.
“Block is a technology partner that truly understands the critical services delivered by the NHS. They responded immediately and their existing knowledge of the Barts network estate ensured that they swiftly became part of the team and were key to helping us resolve the WannaCry situation.”
Sarah Jensen, Chief Information Officer, Barts Health NHS Trust
Though the spread was brought under control and investigation could begin to better understand the nature of the ransomware, Barts’ services were significantly hampered due to key systems being taken offline. To name a few: trauma services, imaging, and the emergency department were all impacted by the system status. It was critical to get back online as quickly as possible.
Partners against cyber crime
By the evening of the 12th May, the Barts team had contacted Block, already a trusted technology partner, to support with additional capacity in resolving the ongoing situation and provide expertise that would compliment Barts’ efforts. The response was almost immediate, and a Block network engineer was deployed onsite that same day. Within 48 hours, a team of 20 highly skilled specialists from Block, including CEO Marc Chang, were working side by side with the Barts team to turn things around. The Block team stayed on site for four weeks and the joint efforts and combined experience of both organisations ensured that a full resolution could be found in a significantly reduced time period.
The experience enhanced the relationship and understanding between both parties, acting as a catalyst for the future development of Barts’ IT and networking strategy. Take a look at our full Barts Health NHS Trust client story to find out more of the ways that we’ve worked together to deliver technology solutions that form the basis of world class healthcare.
