London: A huge extortion cyberattack hit dozens of nations Friday, holding computer data for ransom at hospitals, telecommunications firms and other companies. The attack appeared to exploit a vulnerability purportedly identified for use by the US National Security Agency and later leaked to the internet.
Britain's health service was also hit hard Friday as the attack froze computers at hospitals across the country, shutting down wards, closing emergency rooms and bringing medical treatments to a screeching halt.
Most of the affected hospitals were in England, but several facilities in Scotland also reported being hit. Doctors' practices and pharmacies reported similar problems.
British Prime Minister Theresa May said there was no evidence that patient data had been compromised in the attack, and that it had not specifically targeted the National Health Service.
"It's an international attack and a number of countries and organizations have been affected," she said.
NHS Digital, which oversees UK hospital cybersecurity, says the attack used the Wanna Decryptor variant of malware, which infects and locks computers while the attackers demand a ransom.
Pictures posted on social media showed screens of NHS computers with images demanding payment of $300 worth of the online currency Bitcoin, saying: "Ooops, your files have been encrypted!"
Alan Woodward, visiting professor of computing at the University of Surrey, said there was evidence the ransomware was spreading using a Microsoft flaw exposed in a recent leak of information from U.S. intelligence agencies.
I don't believe it will have been a targeted attack, but will simply have been that the ransomware has sought out those organizations that are running susceptible devices," he said.
Tom Griffiths, who was at Bart's Hospital in London for chemotherapy treatment, said a nurse showed him her computer screen, which carried an image of a padlock.
"It had a countdown clock ticking down, stating that all data would be deleted unless a payment was received within that timeframe," he said.
Spain, meanwhile, activated a special protocol to protect critical infrastructure in response to the "massive infection" of personal and corporate computers in ransomware attacks. The National Center for the Protection of Critical Infrastructure says Friday it was communicating with more than 100 providers of energy, transportation, telecommunications and financial services about the attack.
The Spanish government said several companies had been targeted in ransomware cyberattack that affected the Windows operating system of employees' computers. It said the attacks were carried out with a version of WannaCry ransomware that encrypted files and prompted a demand for money transfers to free up the system.
Spain's Telefonica was among the companies hit.
Griffiths, who was receiving chemotherapy at Bart's, said several cancer patients had to be sent home from Bart's because their records or bloodwork couldn't be accessed.
"Both staff and patients were frankly pretty appalled that somebody, whoever they are, for commercial gain or otherwise, would attack a health care organization," he said. "It's stressful enough for someone going through recovery or treatment for cancer."
The National Cyber Security Centre, part of the GCHQ electronic intelligence agency, said it was working with police and the health system to investigate the attack.
British government officials and intelligence chiefs have repeatedly highlighted the threat to critical infrastructure and the economy from cyberattacks. The National Cyber Security Centre said it had detected 188 "high-level" attacks in just three months.
Krishna Chinthapalli, a doctor at Britain's National Hospital for Neurology & Neurosurgery who wrote a paper on cybersecurity for the British Medical Journal, warned that British hospitals' old operating systems and store of confidential patient information made them an ideal target for blackmailers.
He said many NHS hospitals in Britain use Windows XP software, introduced in 2001, and as government funding for the health service has been squeezed "IT budgets are often one of the first ones to be reduced."
Comments
0 comment