NHS trusts were left vulnerable in a major ransomware attack in May because cyber-security recommendations were not followed, a government report has said.
More than a third of trusts in England were disrupted by the WannaCry ransomware, according to the National Audit Office.
At least 6,900 NHS appointments were cancelled as a result of the attack, the BBC reports.
NHS England said no patient data had been compromised or stolen and praised the staff response.
The NAO chief said the Department of Health and the NHS must now “get their act together”.
WannaCry, which spread to more than 150 countries in a worldwide ransomware outbreak beginning on 12 May, was the biggest cyber-attack to have hit the NHS to date.
The malware encrypted data on infected computers and demanded a ransom roughly equivalent to £230 ($300).
The NAO report said there was no evidence that any NHS organisation paid the ransom – but the financial cost of the incident remained unknown.
An assessment of 88 out of 236 trusts by NHS Digital before the attack found that none passed the required cyber-security standards.
The report said NHS trusts had not acted on critical alerts from NHS Digital and a warning from the Department of Health and the Cabinet Office in 2014 to patch or migrate away from vulnerable older software.
The Department of Health also lacked important information, the report said.
“Before 12 May 2017, the department had no formal mechanism for assessing whether NHS organisations had complied with its advice and guidance.”
Organisations could also have better managed their computers’ firewalls – but in many cases they did not, it said.
NHS organisations have not reported any cases of harm to patients or of their data being stolen as a result of WannaCry.
NHS England has identified 6,912 appointments – including operations – that were cancelled as a direct result of the ransomware.
But it estimated that about 19,000 appointments in total may have been affected.
Cases included at least 139 people potentially with cancer, who had urgent referrals cancelled.
It is not known:
- how many GP appointments were cancelled
- how many ambulances and individuals were diverted from five accident and emergency departments unable to treat some patients
- how many trusts or GPs experienced delays in information, such as test results
The NAO credits the widely reported work of cyber-security researcher Marcus Hutchins, who accidentally helped to stop the spread of WannaCry.
His “kill switch” involved registering a domain name linked to the malware, which deactivated the program’s ability to spread automatically.
A former chairman of NHS Digital, Kingsley Manning, told BBC Radio 4’s Today programme that there was a failure to upgrade old computer systems at the local level.
He said: “The problem with cyber security for the NHS is [that] it has a particular vulnerability… It’s very interconnected so if you get an attack in one place it tends to spread.”
The NAO said the NHS “has accepted that there are lessons to learn” from WannaCry and will now develop a response plan.
It will also ensure that critical cyber-security updates – such as applying software patches – are carried out by IT staff, the NAO said.
WannaCry was “a relatively unsophisticated attack and could have been prevented by the NHS following basic IT security best practice,” said Sir Amyas Morse, comptroller and auditor-general of the NAO.
“There are more sophisticated cyber-threats out there than WannaCry so the Department and the NHS need to get their act together to ensure the NHS is better protected against future attacks.”
Keith McNeil, chief clinical information officer for health and care at NHS England, said: “As the NAO report makes clear, no harm was caused to patients and there were no incidents of patient data being compromised or stolen.
“Tried and tested emergency plans were activated quickly and our hard-working NHS staff went the extra mile to provide patient care, keeping the impact on NHS services and patients to a minimum.”
