Cyber ​​attack: costing the health service nearly €100 million to date

Health Service Executive computers were monitored for viruses during daytime hours only before they were subjected to a cyberattack in May 2021, according to a report.

Before the disastrous and costly attack by a criminal cybergang, there was limited monitoring of the HSE network of 70,000 IT devices, the latest annual report by the Comptroller and Auditor General points out.

A third party provided an antivirus monitoring service between 8am and 6pm each day, with an oncall service outside those hours. Since the attack, the HSE has put in place an enhanced monitoring service providing 24-hour support.

According to the article, the HSE has already paid approximately €100 million in costs as a result of the cyberattack, but more costs are anticipated. Included in this are €51 million in 2021, €4.4 million in revenue expenses, and €2.6 million in legal expenses for the next year, 2022. Additionally, the HSE has obtained a €43 million increase in recurrent budget for ICT expenditure in 2022, of which €38 million is for enhancing its competence to handle potential risks.

According to consultants, the service will require an additional €657 million over the course of seven years for cybersecurity upgrades.

The study on the cyberattack last year claims that only three of the 83 suggestions given by consultants PwC have been properly followed.

The HSE has reacted by saying that many of these suggestions will take several years to finish and that the current status of each item does not accurately reflect the amount of effort done to defend it from a future attack.

Internal audits conducted prior to the intrusion had found problems with the HSE's IT infrastructure, including the usage of out-of-date and unsupported software, the Comptroller and Auditor General report notes.

"Significant investment will be needed in the HSE IT systems to guarantee that they are fit for purpose, that operating platforms are modernised, and to ensure that client and patient personal data is appropriately safeguarded from outside threats."

For the decryption of the Conti ransomware they had installed, the attackers demanded $20 million, however this was not paid. It took until September 2021 to fully decrypt the servers.

The worst-affected areas were scans, blood tests, lab services, maternity, and primary care; staff members were compelled to implement regional workarounds and switch back to paper records to make up for the loss of computer access.

Following the cyberattack, thousands of patient appointments were cancelled, which lengthened waiting lines. According to the paper, it is difficult to distinguish between the attack's and Covid-19's effects.

According to the report, IBM Security examined hundreds of organisations that had recently had data breaches and determined the typical number of days it takes to find the breach and contain it. The HSE was informed of the data breach far sooner (57 days vs an average of 207 days) than the overall average, but it took longer to contain and recover from it (130 days against an average of 70).

There is no estimate of the attack's total cost. These estimates do not account for the expenses incurred by nonprofit organisations or the staff time used to address the issue.

In order to stop the sharing of patient data without its permission, the HSE spent €2.6 million on legal fees, including obtaining a High Court injunction.

Although the study notes that patients, staff, and clients whose personal information was stolen in the attack have not yet been informed of this, the HSE asserts that no legal actions have yet been launched against it by patients harmed by data breaches.

Costs were incurred by other organisations as a result of the occurrence. Individual hospitals have also been impacted, and the Department of Health, which prevented an assault on its systems, has spent about €1 million dealing with the incident and other costs.