Although not aimed specifically at the NHS, the ransomware nonetheless spread across hospital networks, leaving medical staff unable to access patient data, forcing the postponement of some operations as well the diversion of ambulances. Almost 50 NHS Trusts were hit by the WannaCrypt outbreak that left infected computers and hospital kit (MRI scanners, theatre equipment etc) with encrypted files and at least temporarily unusable.
The NAO's terms of reference for the inquiry focus on scoping the impact of the ransomware outbreak, which hit hard on 12 May and caused real world problems for days afterwards.
This investigation will set out the facts about the cyber-attack’s impact on the NHS and its patients; why some parts of the NHS were affected and others were not; and the roles and responsibilities of key stakeholders and how they responded to the attack.
NHS hospitals in Wales and Northern Ireland were unaffected by WannaCrypt, a factor NAO will likely want to consider. The NAO has invited interested parties to submit evidence ahead of an investigation by the UK parliamentary body this autumn.
Lack of accountability and investment in cyber-security was blamed for the severity of the outbreak on the NHS in a recent report by The Chartered Institute for IT, as previously reported. Emergency measures specifically allocated to deal with last month's NHS ransomware attack cost £180,000, according to a government health minister.
There was a lot of focus on the NHS's reliance on obsolete Windows XP systems in the aftermath of the WannaCrypt outbreak. However, post-hack technical analysis revealed that Windows XP systems were more likely to crash than spread the nasty. Unpatched or weakly defended Windows 7 systems left vulnerable against the leaked EternalBlue NSA exploit abused by WannaCrypt were, in practice, a much bigger problem.
The usage of Windows XP in the NHS has reduced from 15-18 per cent at December 2015, to 4.7 per cent of systems, Department of Health minister Jackie Doyle-Price said in a written answer to Parliament late last month. ®