Trusts Sent IT Security Patch That Would Have Protected Them, Says NHS Digital

Trusts Sent IT Security Patch That Would Have Protected Them, Says NHS Digital

Health trusts across England were sent details of an IT security patch that would have protected them from the crippling ransomware attack, NHS Digital said.

Large swathes of the NHS have been paralysed by the cyber attack, which hit 200,000 victims in 150 countries around the world.

The health service has been rebuked for using the outdated Windows XP operating system to store digital information, despite security updates for the software having been discontinued by Microsoft.

The attack has left 47 NHS organisations affected with malware in their system, ranging from hospital trusts to commissioning support units.

Seven hospital trusts are still experiencing serious problems, among them St Bartholomew's Hospital in London, York Teaching Hospital NHS Trust and the University Hospitals of North Midlands Trust.

But NHS Digital said it had made health trusts aware last month of IT protection that could have prevented the attack.

It said in a statement: "NHS Digital issued a targeted update on a secure portal accessible to NHS staff on April 25, and then via a bulletin to more than 10,000 security and IT professionals on April 27 to alert them to this specific issue.

"These alerts included a patch to protect their systems. This guidance was also reissued on Friday following emergence of this issue."

Problems with cyber security in NHS organisations were highlighted last year by Dame Fiona Caldicott, the national data guardian, who warned that issues were given insufficient priority and that health bodies persisted in using obsolete computer systems, The Times said.

Dame Fiona and the Care Quality Commission wrote to Mr Hunt to highlight a "lack of understanding of security issues", the newspaper said, and that "the external cyber threat is becoming a bigger consideration".

They proposed a plan to improve cyber security that included a replacement of outdated systems "as a matter of urgency", calling its continued use "one of the most pressing issues facing IT infrastructure" in the NHS.

But Theresa May rejected claims the Government ignored warnings the NHS was vulnerable to a possible cyber attack, saying warnings had been given to hospital trusts.

During a visit to Oxfordshire, she insisted cyber security was being taken seriously in Whitehall.

Asked if warnings had been ignored, Mrs May said: "No. It was clear warnings were given to hospital trusts but this is not something that focused on attacking the NHS here on the UK."

Mrs May said the Government was putting £2 billion into cyber security.

She added: "Europol say there are 200,000 victims across the world.

"Cyber security is an issue that we need to address. That's why the Government, when we came into Government in 2010, put money into cyber security.

"It's why we are putting £2 billion into cyber security over the coming years and, of course, created the National Cyber Security Centre. We take cyber security seriously."

Security minister Ben Wallace said the Government had put £1.2 billion into combating cyber attacks during the last strategic defence and security review, including a £50 million pot to support NHS IT networks.

And he defended the Government after a National Audit Office report in November warned that taking money away from NHS services would leave them vulnerable, telling BBC Breakfast it was down to individual trusts to protect against vulnerabilities and insisting they had enough money to protect against cyber attacks.

Labour's shadow health secretary, Jonathan Ashworth, in a letter to Health Secretary Jeremy Hunt, said concerns were repeatedly flagged about outdated computer systems.

He accused the Government of "raiding" NHS capital budgets to fund day-to-day spending - a stance backed by Chris Hopson, chief executive of NHS Providers.

Liberal Democrat leader Tim Farron also said Conservative cutbacks had put people at risk.

"Cutting of security for the system and, indeed, their undermining of funding for the NHS as a whole, has put patients, and, indeed, our whole health service, at risk."

Home Secretary Amber Rudd is to chair a meeting of the Government's emergency Cobra committee at the Cabinet Office on Whitehall at 5pm on Monday to assess progress on dealing with the attack.

Also attending will be Health Secretary Jeremy Hunt, who has been conspicuous by his absence since the attack came to light on Friday.

Asked why Mr Hunt had not been making public statements on the incident, the Prime Minister's official spokesman said: "This is an international cyber crime, committed on an unprecedented scale.

"The Home Secretary has the lead on responding to crime and cyber crime and it is quite right that she should be taking the lead.

"The Health Secretary has been working round the clock on co-ordinating the NHS response to this, which has been a hugely impressive response.

"Both the Prime Minister and the Health Secretary pass on their thanks to NHS staff who have been working round the clock over this weekend."

Government officials were meeting during the day to guide the response to the attack, said the PM's spokesman, who said he was not aware of any additional problems coming to light as staff returned to work and switched on their computers on Monday morning.

It was "too early to say" what the overall cost of the attack to public coffers would be, he said.

The spokesman played down suggestions the NHS was placed at additional risk because of its use of outdated Windows XP software.

Other Windows systems had also been affected and just 4.7% of NHS systems were still running XP, he said.

Asked why a £5 million contract with Microsoft to protect the XP machines had been terminated, the spokesman said that £50 million had been made available to NHS bodies for cyber security in the 2015 spending review.

He confirmed that NHS trusts were required not to use unsupported IT systems, under the terms of contracts with the Government which came into force in April.

"That was a contract which came in in April and will take time to flow through," he said. It would be for individual trusts to explain if they had not complied with it.

Asked whether the PM wished to thank blogger Marcus Hutchins, who was hailed a hero after finding the virus's "kill switch", the spokesman said: "There were many organisations and individuals working hard over the weekend. Any action that has been taken to limit the damage is of course welcome."

Close

What's Hot