Hackers are expected to have accessed patient data as part of the HSE ransomware attack, and may now publish it online, a Government Minister has said.
While there is not yet definitive evidence of patient information being compromised, with the HSE on Sunday saying it was still too early to determine if it had happened, Minister of State for Communications Ossian Smyth told The Irish Times: “I expect it has [been accessed] and it wouldn’t surprise me if it was published at some point in the future.”
Mr Smyth stressed, however, the HSE did not centrally store significant amounts of clinical patient data, with much of the information held being administrative rather than related to procedures and conditions.
He said accessing such patient files would be “the first thing [hackers] would do before trying to encrypt data or delete backups”, and that usually such information was sold on and later released either by the hackers or other parties.
Similar attacks, such as one on the Scottish Environment Protection Agency last year saw information published online after ransoms went unpaid, but Mr Smyth said he believed data was regularly posted whether such sums were paid or not.
Second attack
The Garda and National Cyber Security Centre is liaising with Europol on the nature of the ransomware used. Mr Smyth said early indications were that a second attack, on the Department of Health, suspected to be carried out by the same criminal organisation, was not as serious as the HSE hack.
He also said early work done by departments and agencies did not yet indicate the presence of similar ransomware on their systems. Garda sources believe the attacks were by organised criminals, rather than a foreign state.
The HSE is grappling with the impact of the attack, with chief clinical officer Dr Colm Henry saying it was facing significant disruption that could continue “well into the coming week”. The HSE has found it has some clean back-up data and is slowly restoring its services, but it promises to be a slow process.
The effect is likely to be greater in hospitals run directly by the HSE rather than in the large voluntary hospitals, although radiology and diagnostic services are expected to hit across the board.
UHW
There is a widespread cancellation of services at University Hospital Waterford for the coming week due to the ongoing cyber-attack on the HSE’s IT system.
There will be no outpatient clinics; all diagnostics including X-ray, CT scans, MRI appointments and cardiac investigations; endoscopy services and all elective inpatient and day case procedures are cancelled.
The same situation applies to Kilcreene Regional Orthopaedic Hospital.
A small number of procedures may go ahead and in this event patients will be contacted directly.
UHW advises that there are considerable delays at the Emergency Department and on the hospital's ability to deliver normal outpatient services and is reminding people that the ED is for emergency services only.
