Global Cyber Attacks Hit British Hospitals, Spanish Firms

13.5.2017 securityweek  CyberCrime
Britain's National Health Service declared a "major incident" after cyber attacks hit dozens of hospitals on Friday, as security experts pointed to a global campaign that also disrupted Spanish businesses.

Some of the affected hospitals had to divert ambulances, scrap operations and shut down their computer systems or ask patients to avoid contacting their family doctors unless absolutely necessary.

At least 16 organisations within the state-run National Health Service, some of them responsible for several hospitals each, have reported being struck.

"A number of NHS organisations have reported to NHS Digital that they have been affected by a ransomware attack," NHS Digital said in a statement.

NHS Incident Director Anne Rainsberry said: "We ask people to use the NHS wisely while we deal with this major incident which is still ongoing".

Pictures posted on social media showed screens of NHS computers with images demanding payment of $300 (275 euros) worth of the online currency Bitcoin, saying: "Ooops, your files have been encrypted!"

It adds: "Maybe you are looking for a way to recover your files, but do not waste your time."

It demands payment in three days or the price is doubled, and if none is received in seven days the files will be deleted, the screen message claims.

In Spain, employees at telecom giant Telefonica were told to shut down their workstations immediately through megaphone announcements as the attack spread.

Forcepoint Security Labs said that "a major malicious email campaign" consisting of nearly five million emails per hour was spreading the new ransomware.

The group said in a statement that the attack had "global scope", affecting organisations in Australia, Belgium, France, Germany, Italy and Mexico.

- Top spooks on the case -

Britain's National Cyber Security Centre and its National Crime Agency said they were looking into the UK incidents, apparently caused by a piece of malware called Wanna Decryptor.

"At this stage we do not have any evidence that patient data has been accessed," the NHS Digital statement said.

"This attack was not specifically targeted at the NHS and is affecting organisations from across a range of sectors," it added.

Several individual health service trusts in England reported severe problems.

A spokesman for Barts Health NHS Trust in London said it was experiencing "major IT disruption" and delays at all four of its hospitals.

"We have activated our major incident plan to make sure we can maintain the safety and welfare of patients," the spokesman said.

"Ambulances are being diverted to neighbouring hospitals."

Two employees at St Bartholomew's Hospital, which is part of Barts Health, told AFP that all the computers in the hospital had been turned off.

"We have been told that we need to shut down all the computers and even our Wi-Fi on our phones. No computers are currently working," they said, speaking on condition of anonymity as they were not authorised to speak to press.

Caroline Brennan, 41, went to the hospital to see her brother, who had open heart surgery.

"They told us there was a problem. They said the system was down and that they cannot transfer anyone till the computer system was back up so he is still in the theatre.

"They told us to come back in 30 to 40 minutes. They said they started the system again."

- Systems shutdown -

Derbyshire Community Health Services in central England said on Twitter: "All IT systems have been temporarily shut down".

Blackpool Hospitals NHS Trust in northwest England, which includes six hospitals, said: "Please don't attend A&E (accident and emergency) unless it's an emergency".

The United Lincolnshire Hospitals NHS Trust in eastern England scrapped "all outpatient, endoscopy, cardiology and radiology appointments scheduled for this weekend" as it did not know how long the attack would last.

Kubo Macak, a cyber warfare expert at Exeter University, said that if the "investigation shows that the cyber attack was directed by an outside state, it would amount to a violation of the UK's sovereignty".