Is the NHS ready for another WannaCry?

Source: NHE March/April 2018

NHE’s Seamus McDonnell on the plans put in place to protect trusts and other NHS organisations from potential future cyber-attacks.

In May 2017, the NHS’s cyber protection plans were thrust into the limelight after a ransomware programme called WannaCry exposed the weaknesses in current systems – but, nearly a year later, there are still no trusts able to pass NHS Digital’s security inspections.

Out of 200 trusts assessed by the organisation in February 2018, not one was up to the standards set by inspectors, prompting fears the system could be unprepared for a similar kind of attack.

The revelation came at a Public Accounts Committee inquiry where NHS Digital’s deputy chief executive, Rob Shaw, told ministers there was still a “considerable amount” of work left to do to reach standards for cyber security.

Shaw explained that the issue was around ‘patching,’ but reassured ministers that the standards set by the country’s national data guardian, Dame Fiona Caldicott, would take time to reach.

“The amount of effort it takes from NHS providers in such a complex estate to reach the ‘Cyber Essentials Plus’ standard that we assess against, as per the recommendation in Caldicott’s report, is quite a high bar,” he added.

“So, some of them have failed purely on patching, which was the vulnerability around WannaCry.”

The WannaCry attack that began on 12 May is thought to have affected 81 trusts across the country, as well as computers at almost 600 GP surgeries. In total there could have been up to 70,000 devices infected, according to the National Audit Office (NAO).

The programme locked users out of their machines and demanded $300 in return for access to the computer’s hard drive, throwing a number of trusts into turmoil and forcing nearly 7,000 appointments to be cancelled across England.

Despite greater preparations, there are still fears that the systems in place may not be able to support the NHS should a major cyber-attack hit trusts again, especially considering the service had already been warned of a potential future incident up to a year before WannaCry occurred.

A report written by the NAO in October last year scolded the Department of Health and Social Care and NHS England for not doing enough to prepare for the threat, arguing that there was no formal mechanism in place to ensure trusts conformed with guidelines and moved away from outdated operating systems like Windows XP.

The criticism, combined with the WannaCry attack itself, has prompted the government to impose much stricter guidelines and assessments on the capability of NHS bodies.

Shaw, who has served as both chief operating officer and interim chief executive since joining NHS Digital in April 2016, said his organisation had inspected 200 trusts since the attack, a significant rise on the approximately 90 trusts assessed before the incident.

“I always take it better to have information, to know where your vulnerabilities are, so that you can do something about it rather than hope that you will be okay when you do get an attack,” he explained. “These vulnerability reports go back to the trusts and their trust boards to be able to work out how they can then do mitigation.

“Some need to do quite a considerable amount of work, but a number of them are already on the journey that will take them towards meeting that requirement.”

The increasing number of assessments must be a positive, and Shaw’s attitude to their improvement seems to show an overall development in the quality of cyber protection – but, with none of these organisations passing their tests, it is not clear whether the system is truly prepared quite yet.


Enjoying NHE? Subscribe here to receive our weekly news updates or click here to receive a copy of the magazine!


There are no comments. Why not be the first?

Add your comment


national health executive tv

more videos >

latest healthcare news

Highest ever numbers accept GP training posts

19/10/2018Highest ever numbers accept GP training posts

The number of people entering GP training is the highest in NHS history, according to new figures from Health Education England (HEE). A tot... more >
‘No realistic prospect of progress’ for integrated health and social care, PAC warns

19/10/2018‘No realistic prospect of progress’ for integrated health and social care, PAC warns

The government is still “a long way” from achieving an effective strategy for integrated health and social care and has been urged to... more >
One in six trusts could end PFI contracts due to poor performance as NHS heads for £1bn loss

19/10/2018One in six trusts could end PFI contracts due to poor performance as NHS heads for £1bn loss

A new report has revealed that 15% of all NHS trusts using private finance initiatives (PFI) could terminate contracts due to poor performance. ... more >
681 149x260 NHE Subscribe button

the scalpel's daily blog

On your bike!

17/10/2018On your bike!

Sathish Sethuraman, travel and transport plan co-ordinator at Northumbria Healthcare NHS FT, explains how efforts to promote cycling to work at the trust are resulting in more staff travelling on two wheels. At Northumbria Healthcare, we are committed to becoming a greener organisation and reducing the environmental impact of delivering patient care in hospitals and in the community across Northumberland and North Tyneside. From in... more >
read more blog posts from 'the scalpel' >


Duncan Selbie: A step on the journey to population health

24/01/2018Duncan Selbie: A step on the journey to population health

The NHS plays a part in the country’s wellness – but it’s far from being all that matters. Duncan Selbie, chief executive of Pu... more >
Cutting through the fake news

22/11/2017Cutting through the fake news

In an era of so-called ‘fake news’ growing alongside a renewed focus on reducing stigma around mental health, Paul Farmer, chief exec... more >
Tackling infection prevention locally

04/10/2017Tackling infection prevention locally

Dr Emma Burnett, a lecturer and researcher in infection prevention at the University of Dundee’s School of Nursing and Midwifery and a boar... more >
Scan4Safety: benefits across the whole supply chain

02/10/2017Scan4Safety: benefits across the whole supply chain

NHE interviews Gillian Fox, head of eProcurement (Scan4Safety) programme at NHS Supply Chain. How has the Scan4Safety initiative evolved sin... more >

last word

Hard to be optimistic

Hard to be optimistic

Rachel Power, chief executive of the Patients Association, warns that we must be realistic about the very real effects of continued underfunding across the health service. It’s now bey... more > more last word articles >

editor's comment

25/09/2017A hotbed of innovation

This edition of NHE comes hot on the heels of this year’s NHS Expo which, once again, proved to be a huge success at Manchester Central. A number of announcements were made during the event, with the health secretary naming the second wave of NHS digital pioneers, or ‘fast followers’, which follow the initial global digital e... read more >

health service focus

Rules of engagement

01/10/2018Rules of engagement

Using technology to increase patient engagement... more >
Navigate your way to cyber resilience

01/10/2018Navigate your way to cyber resilience

As the NHS celebrates its 70th birthday, Alan... more >