Last May's Wannacry attack which crippled the UK's National Health Service was a relatively simple attack and could have been prevented by the service following basic IT security best practice. Figures released by the National Audit Office reveal that the ransomware attack affected 45 NHS organisations including 37 trusts on the first day and at least 81 out of 236 trusts across England, 595 GP practices, and 603 primary care and other NHS organisations were impacted during the course of the campaign.
Even after being alerted by the Department and Cabinet Office in 2014, who warned about the dangers of using outdated software, NHS trusts did little to update or replace software used at clinics and hospitals. The problem was compounded by the fact that, the Department of Health had no procedures to assess if NHS trusts and hospitals were complying with best practice guidelines to prevent cyber-attacks.
The report continues: The lack of visibility was such that even now, neither the Department nor NHS England knows how many GP appointments were cancelled, how many patients were diverted, or how much the disruption to services cost the NHS. According to NAO, the disruption could have been much worse if the ransomware had not been stopped by a cyber-researcher activating a ‘kill switch'.
The Audit Office also observed that the NHS had not rehearsed for a national cyber-attack, it was not immediately clear who should lead the response as there were problems with communications, that locally NHS staff shared information through personal mobile devices, including using the encrypted WhatsApp application, that infected organisations had unpatched, or unsupported Windows operating systems so were susceptible to the ransomware, and that the NHS has accepted that there are lessons to learn from WannaCry and is taking action.
65000 GDPR Data Breaches In Europe To Date
European privacy authorities have received almost 65,000 data breach notifications since the EU's new privacy law went into full effect. In addition, regulators in 11 European countries have imposed $63 million in General Data Protection Regulation fines.read more
More than half of British firms 'report cyberattacks in 2019'
The proportion of UK firms reporting a cyberattack has jumped, despite most businesses admitting they are under-prepared for breaches, according to research from Hiscox reported by the BBC. The insurer found 55 per cent had faced an attack in 2019, up from 40 per cent last year.read more
Sloppy IT Processes Risk Cyberattacks - McAfee
McAfee this week published a report that turns familiar survey findings on their heads by reporting that most cybersecurity breaches are the result of lax IT processes rather than mistakes made by end users.read more
Cybercrime Soaring Reports MalwareBytes
Cybercrime is accelerating at a worrying rate, reports MalwareBytes in its Q1 2019 report. Every quarter that goes by shows more alarming data as to how much cybercrime activity is going on out there, with organizations and companies being called to face and deal with an increasing amount of threats, coming literally from everywhere.read more