Search the hub
Showing results for tags 'Cybersecurity'.
Found 52 results
-
News Article
Hacked UK trove includes data on newborns, cancer patients...
Patient Safety Learning posted a news article in News
Hackers behind a London hospital attack recently published records that include personal information about pregnant women, newborns, cancer patients, people suffering from schizophrenia and thousands of others across the UK and Ireland, revealing the breach was far more widespread than authorities have previously indicated. An analysis of the data trove by Bloomberg News found that it contains tens of thousands of medical records on patients from more than 400 public and private hospitals and clinics. Among the records are some 40,000 highly sensitive documents sent by doctors requesting biopsies and blood tests for individual patients in all regions of the UK and some hospitals in Ireland. A breach of the kind faced by Synnovis was inevitable, according to Saif Abed, a former NHS doctor and expert in cybersecurity and public health. “The NHS has some of best patient safety and cybersecurity standards in the world,” Abed said. “They are just immensely poorly enforced.” Abed said that there was a lack of mandatory cybersecurity audits on any contractors providing services to the NHS, which meant those contractors could have substandard cybersecurity practices that could in turn leave the NHS vulnerable. Read full story Source: Bloomberg UK, 26 June 2024 -
Content ArticleIn the wake of reports linking IT flaws to deaths of patients and the recent cyber attack on pathology services in south east London, Chris Fleming in an article for Digital Health calls for radical change to make digital safer and more effective
-
News Article
NHS confirms patient data stolen in cyber attack
Patient Safety Learning posted a news article in News
NHS England has confirmed its patient data managed by blood test management organisation Synnovis was stolen in a ransomware attack on 3 June. Qilin, a Russian cyber-criminal group, shared almost 400GB of private information on their darknet site on Thursday night, something they threatened to do in order to extort money from Synnovis. In a statement, NHS England said there is "no evidence" that test results have been published, but that "investigations are ongoing". More than 3,000 hospital and GP appointments were disrupted by the attack. "Patients should continue to attend their appointments unless they have been told otherwise and should access urgent care as they usually would," NHS England said. A sample of the stolen data seen by the BBC includes patient names, dates of birth, NHS numbers and descriptions of blood tests, something cyber security expert Ciaran Martin told the BBC was "one of the most significant and harmful cyber attacks ever in the UK." Read full story Source: BBC News, 24 June 2024 -
News Article
Hacked London NHS hospitals data allegedly published online
Patient Safety Learning posted a news article in News
Data from a ransomware attack has allegedly been published online weeks after the attack halted operations and tests in major London hospitals, NHS England has said. A Russian group is believed to have carried out the cyber-attack on Synnovis, a private pathology firm that analyses blood tests for Guy’s and St Thomas’ NHS foundation trust (GSTT) and King’s College trust, on 3 June, forcing hospitals in the capital to cancel almost 1,600 operations and outpatient appointments. NHS England said on Friday it had “been made aware that the cyber-criminal group published data last night which they are claiming belongs to Synnovis and was stolen as part of this attack. We know how worrying this development may be for many people. We are taking it very seriously.” In the attack, it is understood hackers from the Russian-based ransomware criminal group Qilin infiltrated Synnovis’s IT system and locked the computer system by encrypting its files to extort a payment for restoring access. The trusts have contracts with Synnovis totalling just under £1.1bn for services that are vital to the smooth running of the NHS. NHS England said an analysis of the data was under way involving the National Cyber Security Centre and other partners to confirm whether the data was taken from Synnovis’s systems and what information it contained. Read full story Source: The Guardian, 21 June 2024 -
News Article
Neighbouring providers aid cyber attack victim
Patient Safety Learning posted a news article in News
Two pathology networks are coming to the aid of a neighbour, still largely paralysed following an unprecedented cyber attack on its IT system earlier this month. HSJ has learned that Australian-owned firm Health Services Laboratories, which operates mainly from two NHS trusts in north London, will take on some of the primary care tests in south-east London while the Synnovis systems, which were taken out by the attack, are down. HSL will take on work from Lambeth and Southwark boroughs, while South West London Pathology, an NHS-run consortium based at St George’s Hospital, will take on similar work for GP practices in Bexley and Bromley. SWLP was able to connect electronically to send results back to 70 surgeries in south east London within three days. HSL confirmed it had been drafted in, but it gave no information on what tests it was performing or where, or how it was assuring itself that services in north London would not suffer as a result. Read full story (paywalled) Source: HSJ, 20 June 2024 -
News Article
Man’s life-saving heart surgery cancelled after NHS cyber attack
Patient Safety Learning posted a news article in News
A heart patient has been left fearing for his health after his life-saving operation was cancelled due to a major cyber attack on London NHS hospitals. Russell Ashley-Smith, 81, is waiting for complex open heart surgery at King’s College Hospital in Denmark Hill, south London, without which he may only have up to two years to live. More than 200 emergency procedures were cancelled due to the ransomware hack earlier this month. Mr Ashley-Smith said: “I understand if I don’t [have the operation] it’s terminal. Doctors said you’ll live for one to two years with declining health and become less and less capable of doing things like walking. “I would become more dependent on my wife, and more dependent on being taken somewhere by car if I wanted to go outside. I would be unable to make music – I play the cello and the piano – all the things I like doing and I don’t want to be a couch potato." As well as operations, thousands of patient hospital appointments had to be cancelled across Guy’s and St Thomas’ Foundation Trust and King’s College University Hospital NHS Foundation Trust due to the cyber attack. The NHS admitted on Friday it would take months for services to recover even once the attack has been resolved, as staff will have to rebook patients for appointments and operations. Read full story Source: The Independent, 19 June 2024 -
News Article
Pleas from services crippled by cyber attack rejected due to lack of capacity
Patient Safety Learning posted a news article in News
London pathology providers are “running too hot” to give enough support the large system hit by a cyber attack last week, HSJ has been told. HSJ has learnt that all the capital’s pathology services have now been approached to help Guy’s and St Thomas’ and King’s College Hospital after the IT systems for their provider Synnovis went down, the pressure on the capital’s labs and technical issues limited what help could be given. But one senior manager told HSJ: “Many trusts are keen to help but their hands are tied. The difficulties are that so many medium-sized NHS labs are already running hot and have not got the capacity." HSJ was told there was significant clinical risk in primary care as well. Routine tests that might have picked up something important are not happening and one manager said: “Patients in primary care include those in nursing homes – blood tests and test for infections can be the only way to work out why a frail patient is deteriorating.” Read full story (paywalled) Source: HSJ, 17 June 2024 -
News Article
‘Massive’ cybersecurity risk in NHS supply chain, trust and ICB leader warns
Patient Safety Learning posted a news article in News
The NHS supply chain contains “absolutely massive” cybersecurity risks which have not “really been talked about”, an integrated care board and trust chair has warned. Lena Samuels, who is chair of two London trusts and of Hampshire and Isle of Wight Integrated Care Board, said: “We’ve been talking internally about our own organisations but we haven’t really talked about the supply chain and the risks within that – and that is absolutely massive.” Ms Samuels, speaking at the NHS Confed Expo conference yesterday, said many NHS organisations still needed to question: “How do our risk registers capture what our supply chain resilience looks like in terms of cyber protection?” She said NHS organisations also needed to be considering “who on my board is going to ask that question” and “whether they’re going to even think of asking that question”, adding: “There’s so much that we’ve got to think about.” Read full story (paywalled) Source: HSJ, 14 June 2024 -
News ArticlePatients with cancer and those needing emergency operations were among those who had their treatment cancelled this week due to a major cyberattack on NHS hospitals in London. More than 200 emergency and life-saving operations, including those which should be done within 24 hours, had to be cancelled by Guy’s and St Thomas’ Foundation Trust (GSTT) and King’s College University Hospital NHS Foundation Trust. It is not yet clear how long the disruption will last, however hospitals are concerned they will struggle if it continues for more than a few days. According to a source, Synnovis carries out tens of thousands of tests a day but is unable to do so as it cannot access systems. The Independent revealed: More than a third of procedures and operations have been cancelled, which includes over 3,000 non-surgical appointments and hundreds of patients who have been referred for urgent cancer diagnosis. Mothers waiting to have c-sections have also had their procedures cancelled and hospitals are investigating potential harm. Transplant operations have been cancelled and hospitals have had to reduce the number of people they’re able to book in. Read full story Source: The Independent, 10 June 2024
-
News Article
NHS appeals for O-type blood donations after cyberattack delays transfusions
Patient Safety Learning posted a news article in News
An appeal has been launched for O blood-type donors to book appointments across England after the ransomware attack affecting major London hospitals. NHS Blood and Transplant is appealing for O blood-type donations as this is safe to use for all patients. The cyber-attack means the affected hospitals cannot match patients’ blood at the same frequency as usual. Several London hospitals last week declared a critical incident, cancelled operations and tests, and were unable to carry out blood transfusions after the attack on the pathology firm Synnovis, which Qilin, a Russian group of cybercriminals, is thought to have been behind. Memos to NHS staff at King’s College hospital, Guy’s and St Thomas’ (including the Royal Brompton and the Evelina London Children’s hospital) and primary care services in London said a critical incident had been declared. NHS Blood and Transplant is calling for O-positive and O-negative blood donors to book appointments in one of the 25 NHS blood donor centres in England to boost stocks. The hospitals affected by the cyber-attack cannot match patients’ blood at the same frequency as usual, NHS Blood and Transplant said. For surgeries and procedures requiring blood to take place, hospitals need to use O-type blood as this is safe to use for all patients. Blood has a shelf life of 35 days, so stocks need to be continually replenished, the NHS said. Read full story Source: The Guardian, 10 June 2024 -
News Article
Critical incident declared as cyber attack affects major London hospitals
Patient Safety Learning posted a news article in News
Major hospitals in London have declared a critical incident after a cyber attack led to operations being cancelled and patients being diverted elsewhere for care. NHS officials said they were working with the National Cyber Security Centre after the attack on Synnovis, which provides pathology services to large hospitals and GP surgeries in the capital. The company said the ransomware attack has affected all of its IT systems, which has impacted its pathology services. Some procedures and operations have been cancelled or have been redirected to other NHS providers as hospital bosses continue to establish what work can be carried out safely. Synnovis was the victim of a ransomware cyberattack. This has affected all Synnovis IT systems, resulting in interruptions to many of our pathology services. Mark Dollar, Synnovis chief executive Health service leaders said there has been a “significant impact” King’s College Hospital, Guy’s and St Thomas’ – including the Royal Brompton and the Evelina London Children’s Hospital – and GP services in south-east London. A memo to staff said the “critical incident” has had a “major impact” on the delivery of services, with blood transfusions particularly affected. Patients have described last-minute cancellations to operations and blood tests. Read full story Source: The Independent, 4 June 2024 -
News Article
Cyber attack strikes multiple hospitals
Patient Safety Learning posted a news article in News
A major health system’s pathology IT has been hit by a cyber attack, HSJ understands. A letter sent by Guy’s and St Thomas’ Foundation Trust chief executive last night said his £2.5bn-turnover trust was unable to connect to the servers of Synnovis. The problem is ongoing, and several senior sources told HSJ the system had been the victim of a ransomware attack. One said gaining access to pathology results could take “weeks, not days”. As well as GSTT – the NHS’s largest provider – neighbouring King’s College Hospital FT, which runs several hospitals in the system, and is thought to be affected. Synnovis also provides pathology services for primary care across all six of south east London’s boroughs. The news would make it one of the largest critical NHS systems brought down by a cyber attack. Read full story (paywalled) Source: HSJ, 4 June 2024 -
News ArticleHealthcare providers are failing to protect the privacy of people living with HIV, the UK’s data watchdog has warned. The Information Commissioner’s Office said it has been forced to hand fines worth thousands to organisations which have released the details of those living with HIV. Speaking with The Independent, Information Commissioner John Edwards, said: “It is a huge problem [within healthcare] and it’s a disproportionate amount of our business. “That’s partly because of the seriousness and the sensitivity of health information, the huge scale of the health sector and very many moving parts, with many opportunities for information to slip out as it moves from one place to another, and frankly, they’re just not doing well enough.” In a warning on Tuesday the watchdog highlighted specific concerns over HIV patients’ data being breached through the use of bulk emails in which staff have not used the blind copy function. The Information Commissioner said: “People living with HIV are being failed across the board when it comes to their privacy and urgent improvements are needed across the UK. We have seen repeated basic failures to keep their personal information safe - mistakes that are clear and easy to avoid." Read full story Source: Independent, 30 April 2024
-
News Article
Hackers obtain patient data from NHS Dumfries and Galloway
Patient Safety Learning posted a news article in News
A hacker group is in possession of at least a “small number” of patients’ data following a cyber-attack, NHS Dumfries and Galloway has said. Reports emerged on Wednesday of a post by the group Inc Ransom on its darknet blog, alleging it was in possession of three terabytes of data from NHS Scotland. The post included a “proof pack” of some of the data, which has been confirmed by the board to be genuine. The chief executive of the NHS board, Jeff Ace, said in a statement: “We absolutely deplore the release of confidential patient data as part of this criminal act. “This information has been released by hackers to evidence that this is in their possession. We are continuing to work with Police Scotland, the National Cyber Security Centre, the Scottish government and other agencies in response to this developing situation.” Patients whose data has been leaked will be contacted by the board, he said, while patient-facing services would continue as normal. Read full story Source: The Guardian, 27 March 2024 -
Content ArticleThe use of AI in medical devices, patient screening and other areas of healthcare is increasing. This Medscape article looks at some of the risks associated with the use of AI in healthcare. It outlines the difficulties regulators face in monitoring adaptive systems, the inbuilt bias that can exist in algorithms and cybersecurity and liability issues.
-
News Article
27 ICSs without a plan to combat cyber attacks
Patient Safety Learning posted a news article in News
At least half of all integrated care systems lack a plan to defend the services they oversee from a cyber attack, HSJ has discovered. Integrated care systems are responsible for bolstering the cyber resilience of the organisations in their area. This includes having a “system-wide plan for maintaining robust cyber security”. However, research by HSJ has found that only ten ICSs would confirm they had such a plan. Twenty-six ICSs admitted they did not have a plan in place, while six systems did not respond to HSJ’s inquiries. See the end of the story for the full list. Of those without a plan, only 10 said they were developing one. NHS England had initially asked each ICS to submit draft cyber security strategies by the end of May, before sending final versions by the end of September but is now thought to be drawing up new timelines. Some regions appear particularly exposed. All four ICSs in the North East and Yorkshire region admitted they did not have a cyber security plan, while no ICS in either the London or South East region could confirm they did. An NHSE spokesman told HSJ it was “vital” that ICSs have “robust plans in place to manage the specific cyber risks in their local areas to protect patient data and systems”. Read full story (paywalled) Source: HSJ, 15 January 2024 -
Content ArticleIn May 2021, the Irish public health service was the target of a cyber-attack. The response by the health service resulted in the widespread removal of access to ICT systems. While services including radiology, diagnostics, maternity and oncology were prioritised for reinstatement, recovery efforts continued for over four months. This study describes the response of health service staff to the loss of ICT systems and the risk mitigation measures introduced to safely continue health services. It also explores the resilience displayed by frontline staff whose rapid and innovative response ensured continuity of safe patient care.
-
News Article
The US is trying to fix medical devices’ big cybersecurity problem
Patient Safety Learning posted a news article in News
Medical devices are one major weak point in health care cybersecurity, and both the US Congress and the Food and Drug Administration took steps towards closing that gap this week —Congress with a proposed bill and the FDA with new draft guidelines for device makers on how they should build devices that are less likely to be hacked. Devices like infusion pumps or imaging machines that are connected to the internet can be targets for hacks. Those attacks can siphon off patient data or put their safety directly at risk. Experts consistently find that devices in use today have vulnerabilities that could be exploited by hackers. The new document is still just a draft, and device makers won’t start using it until it’s finalised after another round of feedback. But it includes a few significant changes from the last go-around — including an emphasis on the whole lifecycle of a device and a recommendation that manufacturers include a Software Bill of Materials (SBOM) with all new products that gives users information on the various elements that make up a device. An SBOM makes it easier for users to keep tabs on their devices. If there’s a bug or vulnerability found in a bit of software, for example, a hospital could easily check if their infusion pumps use that specific software. The FDA also put out legislative proposals around medical device cybersecurity, asking asking Congress for more explicit power to make requirements. “The intent is to enable devices to be that much more resilient to withstand the potential for cyber exploits or intrusion,” Schwartz says. Manufacturers should be able to update or patch software problems without hurting the devices’ function, she says. Read full story Source: The Verge, 8 April 2022 -
News Article
Cyber attack takes out two trusts’ records access
Patient Safety Learning posted a news article in News
Two ambulance trusts have been left without a working electronic patient care record system for a week after a cyber attack affecting its Swedish-based supplier. Staff at South Western Ambulance Service Foundation Trust and South Central Ambulance Service FT have been working on paper since the MobiMed system – supplied by the firm Ortivus – went down last Tuesday. More than 1,700 ambulances and clinical workstations use the system, according to the company. One employee told HSJ some staff were struggling with a paper-based system which meant they had less information on patients. ”We can’t do summary care record searches or see previous call information,” the staff member said. SWASFT sent a message to staff on Friday saying the system was likely to be down “for a prolonged period”. Read full story (paywalled) Source: HSJ, 25 July 2023 -
News Article
NHS doctors' paperwork piles up after cyber-attack
Patient Safety Learning posted a news article in News
Doctors say it could take months to process mounting piles of medical paperwork caused by a continuing cyber-attack on an NHS supplier. One out-of-hours GP says patient care is being badly affected as staff enter a fourth week of taking care notes with pen and paper. The ransomware attack against software and services provider Advanced was first spotted on 4 August. The company says it may take another 12 weeks to get some services back online. Dr Fay Wilson, who manages an urgent-care centre in the West Midlands, says the main choke point for her team is with patient records. She said it could affect patient care "because we can't send notifications to GP practices, except by methods that don't work because they require a lot of manual handling, and we haven't got the staff to actually do the manual handling". Read full story Source: BBC News, 31 August 2022 -
News Article
Trusts warn of continued care delay as IT outage goes on
Patient Safety Learning posted a news article in News
Mental health trusts continue to suffer much disruption after a cyber attack left them unable to access their electronic patient records. Several trusts which use Advanced’s CareNotes EPR are grappling with the system being down, although the company said on Friday some progress had been made to restore the EPR. One source at an affected mental health trust said there had been “not much in the way of improvements”, while another said they feared it could be “months” before they can fully access the EPR. NHS England’s mental health director Claire Murdoch is regularly raising issue nationally, HSJ was told, as response teams work with Advanced to investigate and restore IT systems, which were taken offline after the company was hit by a cyber attack two weeks ago. Hereford and Worcestershire Health and Care Trust has told its patients they might have to “provide more detail on your medical history to ensure clinicians have the most up-to-date information”, while Oxford Health Foundation Trust warned the technical issues could cause delays to patient care. Read full story (paywalled) Source: HSJ, 21 August 2022 -
News ArticleAs the risk of cyberattacks on medical devices continues to mount, the Food and Drug Administration isn’t doing enough to ensure device makers include adequate security in their products, experts say. They charge that part of the problem is that the agency lacks the funds and the trained personnel to evaluate the cyber risk the devices carry and enforce the rules it does have on the books for approving devices. “I’ve spoken to device manufacturers, specifically product security people at device manufacturers, saying that they’ve been telling their organizations for the last year or two that they need to include cybersecurity as part of their submissions or else they’re going to get rejected,” said Mike Kijewski, CEO of medical device cybersecurity firm MedCrypt. “Yet for some of their recent submissions, they didn’t have a lot of cybersecurity documentation and they still got accepted by the FDA.” Cyberattacks remain a significant risk for healthcare companies. US patient safety group ECRI reported 173 medical device cybersecurity alerts in the past five years. The organisation warned that cybersecurity incidents don’t just disrupt business operations, but can “pose a real threat of physical harm.” For instance, ransomware attacks on hospitals can cause device outages that disrupt patient care, and at worst, put lives at risk. Read full story Source: MedTech Dive, 11 August 2022
-
News ArticleCriminals have issued ‘demands’ to an NHS IT supplier targeted by a cyber attack, leading health chiefs to fear they have accessed confidential patient data, HSJ has learned. IT firm Advanced was targeted last week. The company provides electronic patient records to several trusts and most NHS 111 providers. Multiple government agencies – including the National Crime Agency and GCHQ – are now working to identify the extent of the damage caused by the attackers, while leaders of affected mental health trusts have warned of a “pretty desperate” situation as staff are unable to access vital patient records. In a statement issued last night, Advanced said: “With respect to potentially impacted data, our investigation is under way, and when we have more information about potential data access or exfiltration, we will update customers as appropriate.” Read full story (paywalled) Source HSJ, 11 August 2022
-
News Article
Cyber attack: NHS staff unable to access patient notes for three weeks
Patient Safety Learning posted a news article in News
A cyber attack that has caused a major outage of NHS IT systems is expected to last for more than three weeks, leaving doctors unable to see patients’ notes, The Independent has learned. Mental health trusts across the country will be left unable to access patient notes for weeks, and possibly months. Oxford Health Foundation Trust has declared a critical incident over the outage, which is believed to affect dozens of trusts, and has told staff it is putting emergency plans in place. One NHS trust chief said the situation could possibly last for “months” with several mental health trusts, and there was concern among leaders that the problem is not being prioritised. In an email to staff, Oxford Health Foundation Trust chief executive Nick Broughton, said: “The cyber attack targeted systems used to refer patients for care, including ambulances being dispatched, out-of-hours appointment bookings, triage, out-of-hours care, emergency prescriptions and safety alerts. It also targeted the finance system used by the Trust." The NHS director said: “The whole thing is down. It’s really alarming…we’re carrying a lot of risk as a result of it because you can’t get records and details of assessments, prescribing, key observations, medical mental health act observations. You can’t see any of it…Staff are going to have to write everything down and input it later.” They added: “There is increased risk to patients. We’re finding hard to discharge people, for example to housing providers, because we can’t access records.” Read full story Source: The Independent, 11 August 2022 -
News Article
Cyber attack triggers 111 ‘total system outage’
Patient Safety Learning posted a news article in News
Many NHS 111 services are without a crucial IT system for several days, after a cyber attack on a software supplier. Providers had to move to pen-and-paper yesterday, and have been unable to access patient records. Adastra – which is used by 85% of NHS 111 providers – went offline at 7am on Thursday. It was still affected as of Sunday, and staff were told it may not be online for several days. Advanced, which supplies Adastra, confirmed on Friday evening the incident was caused by a cyberattck, but says it managed to limit the damage to a small number of its servers. It was reported on Saturday that the attack is thought to have been by a criminal group trying to extort money — so-called ransomware — rather than an attack by a group linked to a state/government. As well as NHS 111, the system is used by some GP out-of-hours services and has also been marketed to urgent care providers. NHS 111 services have had to use lists of protocols when answering calls and write details down, rather than the software automatically implementing the protocols. One briefing note from commissioners in London, seen by HSJ, described the issue as a “total system outage” for NHS 111, and said “likely delays for patients… will continue throughout the weekend and potentially over next week”. Read full story (paywalled) Source: HSJ, 8 August 2022
