WannaCry and the NHS: what the UK's biggest health cyber attack taught us

Nabayn did not work on this incident. This is our analysis of what is on the public record, written so other organisations can learn from it.

On Friday 12 May 2017, a computer virus called WannaCry spread around the world, encrypting data and demanding a ransom. In England it hit the NHS hard: appointments were cancelled, and in some areas patients had to travel further for emergency care. The official investigation’s finding should interest any business owner, because it called the attack relatively unsophisticated.

What happened

WannaCry encrypts data on infected computers and demands a ransom payment to allow access. It was the largest cyber attack to affect the NHS in England.¹

According to the National Audit Office, at least 81 of 236 trusts across England were affected, disrupting at least 34% of trusts. A further 603 primary care and other NHS organisations were infected, including 595 GP practices. NHS England identified 6,912 cancelled appointments and estimated over 19,000 would have been cancelled in total. In five areas, patients had to travel further to accident and emergency departments.¹

No NHS organisation paid the ransom, according to the Department of Health, NHS England and the National Crime Agency. However, the Department did not know how much the disruption cost the NHS.¹

Could it have been prevented?

The report is direct. NHS Digital told the NAO that all organisations infected shared the same vulnerability, and could have taken relatively simple action to protect themselves. Infected organisations had unpatched or unsupported Windows operating systems. Whether they had patched or not, managing their internet-facing firewalls would also have guarded against infection.¹

The warnings had already been given. In 2014, the Department and Cabinet Office told trusts it was essential to have robust plans to move away from old software such as Windows XP by April 2015. In March and April 2017, NHS Digital issued critical alerts telling organisations to patch their systems.¹

The head of the NAO said it was a relatively unsophisticated attack, and could have been prevented by the NHS following basic IT security best practice.¹

How the response went

The Department had a plan for responding to an attack, but it had not tested the plan at a local level. As the NHS had not rehearsed for a national cyber attack, it was not immediately clear who should lead, and there were problems with communications. Many local organisations could not communicate with national bodies by email, because they had been infected or had shut down their email as a precaution.¹

The attack could have caused more disruption if a cyber researcher had not activated a “kill switch” that stopped WannaCry locking devices.¹ In other words, part of what limited the damage was good fortune.

The Department of Health later published a progress update on securing cyber resilience in health and care.²

What a small business can learn

Get off unsupported software. An old computer that “still works” no longer receives security fixes. Find out what you are running, and plan to replace anything out of support. This is our suggestion, and it comes directly from the finding above.

Act on security alerts. Updates released in March were still not installed in May. Turn on automatic updates wherever you can.

Check your firewall. The NAO notes this would have protected organisations regardless of patching. Most small businesses can check this with their internet provider or IT support, using a simple question: what is open to the internet?

Test your plan. A plan that has never been tried has unknown gaps. Sit down for 30 minutes and walk through it: it is Monday morning, and all your computers are locked. What do you do?

Do not rely on email for emergencies. This was a specific problem in the NHS response. Keep a phone list on paper, and agree another way for your team to communicate.

Remember the people affected. The real cost of a cyber incident lands on your customers. That is a good reason to prepare, whatever your size.

These basics are close to what the government-backed Cyber Essentials scheme asks for.³ See Cyber Essentials for small businesses.