Advertisement

We need your help now

Support from readers like you keeps The Journal open.

You are visiting us because we have something you value. Independent, unbiased news that tells the truth. Advertising revenue goes some way to support our mission, but this year it has not been enough.

If you've seen value in our reporting, please contribute what you can, so we can continue to produce accurate and meaningful journalism. For everyone who needs it.

Shutterstock/solarseven

Risk patients' medical data affected by HSE ransomware attack 'will be abused', government warns

Since Friday, the health and security arms of Government have been scrambling to take control of the situation.

LAST UPDATE | 17 May 2021

THERE IS A risk that medical and other patient data affected by the ransomware attack on the HSE “will be abused”, the Government has warned. 

In a statement this evening, the government said: “These ransomware attacks are despicable crimes, most especially when they target critical health infrastructure and sensitive patient data.”

Since the HSE announced on Friday that it had been the target of the ransomware attack, in which patient and staff data may have been compromised, the health and security arms of government have been scrambling to take control of the situation.

On Friday, the Master of the Rotunda Maternity Hospital announced on Morning Ireland that its IT system was down, and that it was operating by the “traditional”, paper-based system until further notice.

Minutes later, it was revealed that the issue affected the whole HSE patient system – and all national and local IT systems involved in transferring or storing data needed to be shut down as a precaution.

Around 86,000 computers have been turned off, and a security team are going through 2,000 systems within the HSE to decide what level of access has been gained in the attack. The HSE has said publicly that it is still unclear what data hackers gained access to, whether that be administrative data, patient data, or staff data.

The HSE’s IT systems were hit by a Conti ransomware attack, where attackers enter into a computer system, study how it works, and encrypt the private data before announcing their attack to the victim and demanding a ransom for it not to be published online.

This particular attack was carried out by an international cyber-crime gang, the Government said in a statement this evening. 

“It is aimed at nothing other than extorting money and those who carried it out have no concern for the severe impact on patients needing care or for the privacy of those whose private information has been stolen,” it said, adding: 

“These ransomware attacks are despicable crimes, most especially when they target critical health infrastructure and sensitive patient data. The significant disruption to health services is to be condemned, especially at this time. 
“Any public release by the criminals behind this attack of any stolen patient data is equally and utterly contemptible. There is a risk that the medical and other data of patients will be abused. Anyone who is affected is urged to contact the HSE and Garda authorities.”

The Government said its main concern is to secure as speedy a resumption of all medical services “as can possibly be achieved, consistent with ensuring that the HSE’s systems can be safely and robustly restored”. 

There is currently hundreds of people deployed to tackle this attack in accordance with the predetermined plan for such cyber attacks, according to the statement.  

Minister for Justice Heather Humphreys today met with the Garda Commissioner and the head of the Garda Cybercrime Bureau Chief Superintendent Paul Clearly in relation to the attack.

Garda Commissioner Drew Harris informed Humphreys that An Garda Síochána is providing its full support to the National Cyber Security Centre, which is leading the State response to the attack, and is also liaising and cooperating with international law enforcement partners. 

Taoiseach Micheál Martin, Tánaiste Leo Varadkar, Transport Minister Eamon Ryan, Justice Minister Heather Humphreys, Health Minister Stephen Donnelly and Minister of State for Communications Ossian Smyth also met this afternoon to discuss the attack. 

Tomorrow morning, the Oireachtas Transport and Communications Networks committee will hear from officials from the Department of Communications and the National Cyber Security Centre after requesting an “immediate meeting”.

TDs and Senators will raise issues such as how the breaches occurred, the strategy in place to fully repel the attacks and timescale involved for the resumption of normal operations.

As with all security issues, information about the exact amount being sought is scarce and muddled: particularly around what data the hackers have gained access to, and what ransom amount has been sought by hackers.

Ransom speculation

Reports in Sunday newspapers yesterday indicated that hackers may have had access to the HSE system up to two weeks before a ransom was demanded, and reported widely varied ransom amounts being demanded.

The Business Post reported that the hackers demanded three bitcoin or $150,000, while others cited $20 million – a figure first reported by tech website Bleeping Computer.

Neither amounts have been confirmed as accurate by the HSE or Government.

What services are affected

The main crux of the problem for the HSE is that its core patient system, and its radiation diagnostic system ‘Nimis’, are down.

Yesterday on Newstalk’s On The Record, HSE Chief Operations Officer Anne O’Connor gave a general overview of what had been cancelled, including: X-ray appointments, paediatric services, and hospital outpatient appointments in the west were more severely affected.

O’Connor said that the voluntary hospitals – including the Mater, Beaumont, James’, Vincent’s, Tallaght, Mercy and South Infirmary – operate on a different IT system, so that they were impacted, but not as severely.

Beaumont and Connolly appointments are also going ahead, but similar to the voluntary hospital, radiology is still affected. 

Hospitals in the West – Donegal, Sligo, Mayo, and Galway – have cancelled all outpatient appointments; if your appointment is proceeding they will contact you, O’Connor added. The same is the case with children’s health appointments: Crumlin, Temple Street, and Tallaght have cancelled appointments.

Almost all radiation appointments, including X-ray, MRI, and CT scans, have been cancelled, as computers are needed to assess scans.

At Mercy University Hospital in Cork, the ongoing cyber attack has caused “considerable delays” in the emergency department and has affected outpatient services. All radiology OPD appointments and the processing of GP urgent bloods have been cancelled for the remainder of the week. Any patients with an appointment between now and 21 May are urged to contact the hospital to reconfirm their appointment.

The Covid-19 vaccination programme and testing regime is largely unaffected, as it is a newer, separate IT system. 

O’Connor said that there was a risk for the HSE in treating patients with a purely paper-based system.

We can’t order lab tests or radiology electronically. So normally, if you’re in a hospital, it’s all done through computers, and results come back. So for anybody coming in, its back to manual, hand-written notes. We have people in hospitals delivering pieces of papers with lab results, so it really is going back many, many years. There’s a risk with that.
Our priority has got to be to get a patient system back that gives us access to people’s information. So even things like blood transfusions, matching bloods, looking at previous records with medications, allergies, etc – we don’t have access.

The child and family agency Tusla has also been impacted by the attack. Over 90% of the agency’s connectivity, databases and operating systems are on the HSE platform. 

Speaking to RTÉ’s News at One today, Tusla CEO Bernard Gloster explained that the agency’s main casework in child protection, welfare and children in case work is hosted on the National Childcare Information System (NCIS). 

“All the case management information is on that system and that system is currently not available to us. It was switched off as part of the HSE containment, correctly, on Friday morning,” Gloster said. 

Gloster said Tusla has about 20,000 cases open between child protection, welfare and children in care. Those case files are located on the NCIS system, and as a result, are not currently available to Tusla. 

“We can do a significant amount of our work today in terms of engaging with the public, but in terms of having all of the necessary information, the tools to do that, we are quite limited,” he said. 

Anyone who wishes to make a referral about a child can currently do so by contacting local Tusla offices, phone numbers for which are located on the agency’s website. 

People having difficulty locating a phone number of a local Tusla office can call the main office number on 01 771 8500.

What progress has been made

The HSE’s website page of what health services are still available at what hospitals will be updated every hour.

The statement from Government this evening said: “The HSE is continuing the make the necessary arrangements in the interim to provide the maximum possible availability of services to patients across the State. 

“While the process will, inevitably, take some time, the HSE and its partners are working to ensure that the maintenance and restoration of care for patients can progress in the coming days.” 

HSE CEO Paul Reid said on Morning Ireland today that progress had been made over the weekend in going through all of the HSE’s systems and clearing them out one by one. 

He said it would cost “tens of millions” to fix and rebuild the HSE’s IT system from ‘clean’, back-up data. Even after all systems are cleared, it’s possible that hackers could publish any data they obtained if a ransom is not paid.

He said that the capacity of private hospitals will be used, particularly in oncology, to ensure that patients continued to receive the care they needed.

“The risks increase every day as we progress, it’s having very serious impact on people and has very severe consequences for us,” he said, adding that it would impact the HSE “well throughout this week”. 

When asked whether private information could be published online by the hackers, Reid said “that’s what these organisations set out to do”. 

Everything we’re doing since we became aware of this on Friday is setting out to mitigate that, to rebuild our services, to reassess what has been accessed, what may have been accessed, taking back security – but it’s a really difficult process we’re in.
With reporting by Hayley Halpin

Readers like you are keeping these stories free for everyone...
A mix of advertising and supporting contributions helps keep paywalls away from valuable information like this article. Over 5,000 readers like you have already stepped up and support us with a monthly payment or a once-off donation.

Close
70 Comments
This is YOUR comments community. Stay civil, stay constructive, stay on topic. Please familiarise yourself with our comments policy here before taking part.
Leave a Comment
    Install the app to use these features.
    Mute Mary Walshe
    Favourite Mary Walshe
    Report
    Apr 16th 2023, 8:27 PM

    How the other half live eh?
    But seriously though, doing well for a 28 year old, keep it up!

    432
    Install the app to use these features.
    Mute zephyrum
    Favourite zephyrum
    Report
    Apr 17th 2023, 5:04 AM

    @Mary Walshe: indeed. Bring home the bacon despite no bacon

    67
    Install the app to use these features.
    Mute Yvon Queguiner
    Favourite Yvon Queguiner
    Report
    Apr 16th 2023, 8:29 PM

    Good job! That’s my base salary here and I surely don’t have 10k after the taxes (which are used for only god’s know what with poor healthcare, poor education, expensive childcare, poor public service overall).

    349
    Install the app to use these features.
    Mute Alan Dempsey
    Favourite Alan Dempsey
    Report
    Apr 16th 2023, 9:46 PM

    @Yvon Queguiner:

    Poor Education?

    123
    Install the app to use these features.
    Mute thesaltyurchin
    Favourite thesaltyurchin
    Report
    Apr 17th 2023, 8:51 AM

    @Yvon Queguiner: Education is the only service we’ve had that is decent, but yea slowly it’s being torn apart by misguided Irish opinion. Also add Housing and Transport.

    38
    See 1 more reply ▾
    Install the app to use these features.
    Mute Simran Collops
    Favourite Simran Collops
    Report
    Apr 17th 2023, 4:58 PM

    @thesaltyurchin: Despite unrealistic public expectation and far too much of the funding wasted in bureaucracy, Ireland’s Health service is world class.

    6
    Install the app to use these features.
    Mute Michael
    Favourite Michael
    Report
    Apr 16th 2023, 8:24 PM

    Before anyone says anything about the salary it’s very average for the UAE. As a past resident if I can one piece of advice to the 28 year old consultant. DO NOT take out any loans or credit cards that’s how they get to keep you as you are stuck if you do

    220
    Install the app to use these features.
    Mute Paulco
    Favourite Paulco
    Report
    Apr 16th 2023, 8:21 PM

    Riveting!! Zzzzzzzzz

    174
    Install the app to use these features.
    Mute Giboulées des bâtards
    Favourite Giboulées des bâtards
    Report
    Apr 16th 2023, 8:28 PM

    For some odd reason Engineering consultants in Ireland get half the rate than on the continent. The average charge out rate for a civil Engineer in Scandinavia is the equivalent of 188 euros an hour.

    83
    Install the app to use these features.
    Mute David Chadwick
    Favourite David Chadwick
    Report
    Apr 17th 2023, 7:38 AM

    1125 for rent in the UAE , you wouldn’t get a bed sit in Waterford for that

    77
    Install the app to use these features.
    Mute thesaltyurchin
    Favourite thesaltyurchin
    Report
    Apr 17th 2023, 9:06 AM

    @David Chadwick: yea but we’re all living the dream here.

    27
    Install the app to use these features.
    Mute Craic_a_tower
    Favourite Craic_a_tower
    Report
    Apr 17th 2023, 10:06 AM

    @David Chadwick: well your property here probably wasn’t built using slave labour like there.

    26
    Install the app to use these features.
    Mute Communist Party
    Favourite Communist Party
    Report
    Apr 16th 2023, 8:37 PM

    A salary of 120k is just over 1% of workers in ireland. But 54% are college educated in Ireland. From Revenue’s “Analysis of High Income Individuals”

    71
    Install the app to use these features.
    Mute Fallible Guy
    Favourite Fallible Guy
    Report
    Apr 16th 2023, 9:37 PM

    @Communist Party: Well, ~14% of workers in Ireland are above €100k according to recent statistics perpetuated by Newstalk. I doubt €120k is a hard ceiling for said individuals.

    50
    Install the app to use these features.
    Mute Kieran Menon
    Favourite Kieran Menon
    Report
    Apr 16th 2023, 8:29 PM

    He’s a peasant with that salary over there when everyone and their grandma drives a Rolls Royce.

    66
    Install the app to use these features.
    Mute Fuji Hakayito
    Favourite Fuji Hakayito
    Report
    Apr 16th 2023, 8:34 PM

    @Kieran Menon: and you’re point being?

    105
    Install the app to use these features.
    Mute pkunzip doom2.zip
    Favourite pkunzip doom2.zip
    Report
    Apr 17th 2023, 12:34 AM

    @Fuji Hakayito: he is

    15
    See 1 more reply ▾
    Install the app to use these features.
    Mute Brian Casey
    Favourite Brian Casey
    Report
    Apr 17th 2023, 7:13 AM

    @Kieran Menon: Certainly not a peasant, on that salary he has a good standard of living. Remember it’s tax free, his healthcare is paid for, and by the way the healthcare system here is world class. VAT is only 5%, the weather is incredible 8 months of the year and petrol is far cheaper than back home. I live here too so I can attest to this. So he’s definitely doing better than he would be back in Ireland, that I know for sure

    54
    Install the app to use these features.
    Mute Paul
    Favourite Paul
    Report
    Apr 17th 2023, 9:33 AM

    Fair play.
    Work hard, take risks, get rewarded.

    In Ireland people who do this are vilified by the Left and taxed mercilessly to pay for the perpetually lazy.

    71
    Install the app to use these features.
    Mute SolidSid
    Favourite SolidSid
    Report
    Apr 17th 2023, 12:16 PM

    @Paul: You really do need to get over yourself and stop blaming everybody but yourself for your bad decisions that left you paying for someone else to live in ‘your’ house. It’s not the fault of ‘the left’, it’s yours and yours alone. Be a big boy now and own it and stop stamping your feet like a child whose ice-cram just fell on the floor.

    17
    Install the app to use these features.
    Mute mark boyle
    Favourite mark boyle
    Report
    Apr 17th 2023, 9:42 AM

    fair play to you, far away hills are not green, make sure you dont come home !!

    17
Submit a report
Please help us understand how this comment violates our community guidelines.
Thank you for the feedback
Your feedback has been sent to our team for review.

Leave a commentcancel

 
JournalTv
News in 60 seconds