According to research, the Irish health cyber-attack may have been far worse

The repercussions of a cyber-attack on Ireland’s health service in May, according to an independent report, could have been considerably worse.

Ransomware locked employees out of their computers, causing serious disruptions in the country’s healthcare. However, the research stated that data loss, Covid-19 vaccination systems, or specialised medical devices would have been even worse.

It went on to say that the attack had a much bigger impact than expected.

The healthcare executive commissioned PricewaterhouseCoopers (PWC) to write a research that indicated that systems are still vulnerable to potentially more significant attacks in the future.

The attackers demanded money to regain access to the computer systems, and it took four months for the service to fully recover. On March 18th, someone from the Irish Health Service Executive (HSE) looked over a spreadsheet that had been emailed to them two days previously. The file, however, had been infected with spyware.

The criminal team behind the email worked their way through the networks for the next two months.

The research revealed that there were many warning signals that they were at work, but no inquiry was undertaken, which meant that a critical opportunity to intervene was wasted.

More than 80% of IT infrastructure was impacted, resulting in the loss of critical patient information and diagnostics, wreaking havoc on the health service and the delivery of care.

About 130,000 individuals work for the HSE, which provides health and social services to Ireland’s five million citizens. However, all computer systems were turned down. Doctors, nurses, and other healthcare staff were denied access to patient information, clinical services, and laboratory systems. Emails were down, so employees had to rely on pen and paper.

Data from lab tests had to be handwritten and manually recorded, which increased the possibility of errors.

The thieves had left directions on how to contact them, but the Irish government stated on the day of the attack that no ransom would be paid. All of the computer servers didn’t come back online until late September.

To protect against similar accidents, the report found that transformational change in technology and cyber-security was essential, and it advised that other organisations should learn from this example.