Similar requests freedom of information requests have been carried out before on NHS Trusts, but RES managed to obtain an answer from all 260 trusts in England, Scotland and Wales.
The FOI request has uncovered incredibly high levels of ransomware attacks focused on NHS trusts through.
By requesting information on whether trusts across England, Scotland and Wales had been targeted by ransomware in the last 18 months, it was revealed that 87 of 260 trusts have had to deal with attacks – just under 34% of all requested.
While other FOI requests regarding cyber attacks on the NHS have taken place, this level of FOI data on the topic is unprecedented and paints a grim picture of the number of illegal attacks focused on the NHS.
All 260 trusts responded to the request for information, with 18 claiming exemption to providing information due to data rules around the safety of their patients. A further four either had been absorbed by another trust or didn’t hold the relevant information that attackers would target.
>See also: 30% of NHS Trusts were victims of ransomware attacks
In England, 79 out of 239 trusts (33%) admitted to being targeted by ransomware in the last 12 months. Wales had four out of seven trusts claim exemption, while Scotland had by far the biggest issue with 8 out of 14 NHS trusts (57%) attacked.
Ransomware refers to a particular type of cyber attack on an organisation. When it occurs, data is locked and encrypted by the attackers, who will only release this data back to the organisation once a ransom – often demanded in bitcoins – is paid.
However, there is no guarantee that the information will be returned, or that it won’t have been duplicated, decrypted or permanently corrupted by the ransom process.
Experts suggest that paying the ransom is the worst thing an organisation can do. Instead implementing an effective backup and recovery system is the answer.
>See also: Data analytics: addressing the A&E crisis facing NHS Trusts
Jason Allaway, VP of UK & Ireland at RES, comments: “Healthcare organisations such as these NHS trusts are a prime target for attackers due to the nature of the data they hold. Rather than the purely monetary value of data from many businesses and other sectors, healthcare has long been a top target for ransomware attacks as access to the data they hold can literally be the difference between life or death. Hackers know the hospital will have to pay or risk patients’ wellbeing.”
“It’s important to unearth such statistics as it shows just how seriously this threat needs to be taken by healthcare organisations. Education, vigilance and proven technology such as context-aware access controls, comprehensive blacklisting and whitelisting, read-only access, automated de-provisioning and adequate back-up are some of the vital components that need to be put in place by these trusts to both prevent and combat this problem as efficiently as possible.”
“You only need to look to other areas of business, such as the private sector and education, to see how common these attacks are and how often they can prove successful. It’s not a case of if you are attacked – it’s more of a question of when.”
