NHS could be hit again by cyber hackers as hospitals forced to cancel operations - experts

IT experts have issued a stark warning that the NHS could face future threats following a cyber hack that saw five London hospitals targeted on Monday. This incident should be a “wake-up call” they said, claiming that the health body is a “prime target” for such attacks.

As reported, Royal Brompton, Harefield, Guy's, St Thomas' and King's College Hospitals were all affected by the attack.

Some had to cancel operations and blood transfusions after IT firm Synnovis, which serves NHS pathology labs, was compromised.

As a result of the attack, some departments could not connect to their main server.

Speaking to Express.co.uk, Simon Pardo - director of technology specialists Computer Care, said: “This latest cyber attack on the NHS is a wake-up call about the threat that ransomware and other malicious hacks pose to critical infrastructure and services.

“An organisation the size of the NHS relies on thousands of suppliers, and ensuring that every one of them is cyber secure is like playing a high-stakes game of whack-a-mole.

“Trusts need to look after their own security systems, while performing due diligence on their providers to make sure that hackers cannot affect patients via the back door.

“Any disruption to NHS systems can directly harm patients by shutting down electronic health records, appointment bookings systems, prescription services, and even connected medical devices.”

He added: “The NHS needs a disaster recovery plan for each and every one of its suppliers that is regularly and rigorously tested to defend against situations like this.

“While no security is perfect, investing in robust, round-the-clock defences is essential for the NHS to safeguard both its digital infrastructure and the millions who depend on it for care.”

Another expert, Peter Mackenzie - director of incident response at Sophos, said that “unfortunately” healthcare organisations will continue to be “a prime target for ransomware attacks”.

This is because the services they provide are so critical, and this “puts pressure on the targets to get back online as fast as possible”.

He continued: “We’ve already seen several high-profile ransomware attacks against hospital systems this past year around the world, and Sophos’ most recent State of Ransomware report found that 63 percent of UK healthcare organisations were hit by ransomware in the last year (although most were able to stop the attack before the data was encrypted).

“Further complicating matters is the rise in supply chain attacks across industries.

“They are a preferred method of compromise for a number of criminal groups because, as well as being difficult to defend against, they also have a ripple effect, allowing attackers to infiltrate multiple systems at a time.

“In fact, IT and cyber professionals working in the UK healthcare sector perceive partners and the supply chain to be their single biggest cybersecurity risk.”

David Atkinson, chief executive officer of SenseOn, agreed. He said: “Hackers typically have three core goals: stealing your data, destroying your data, or using access to your network to attack the infrastructure. The NHS is a particularly attractive and high-profile target, ticking all three ‘goal-boxes’ for bad actors.”

"The NHS holds a vast amount of sensitive data, including patient records and personally identifiable information (PII), which can be used for fraud or identity theft.

"The NHS is also a critical component to our nation’s critical infrastructure which delivers core essential services to many in need. The pressure on people within this ecosystem and the headlines it grabs increases the likelihood of the victim of the attack to pay the ransom."

He said the incident shared similarities with a 111 ransomware attack on the NHS’s software supplier back in 2022.

"The incident disrupted the emergency phoneline service with IT systems causing severe delays in response times and overcrowding in already over-stretched A&E departments," he said.

“While the group was never identified in the 111 attack, ransomware groups like these will continue to hit NHS systems, suppliers and the broader healthcare industry. The NHS faces tough times with recent budget cuts and staff shortages and may be more vulnerable to those in the private sector with larger IT budgets."

And Brad Freeman, director of technology at SenseOn, warned this might not be the last attack of its kind on the NHS.

“Once an attacker has breached an organisation their knowledge of a victim's cyber terrain will increase the risk of future compromise,” he added.

“This is especially true if the attacker has not yet extorted a ransom from their victim and they may think that a more significant breach would.”