Skip to main content

NHS services across England have been hit by IT failure, believed to be caused by a large-scale cyber-attack.

 

Trusts and hospitals in London, Blackburn, Nottingham, Cumbria and Hertfordshire have been affected.

 

Some GP surgeries have had to shut down phone and IT systems while A&Es have told people not to attend unless it's a real emergency.

 

NHS England says it is aware of the issue and is looking into it.

 

Among those affected is the East and North Hertfordshire NHS Trust which says it is experiencing problems with computers and phone systems.

 

It has postponed all non-urgent activity and is asking people not to come to A&E at the Lister Hospital in Stevenage.

 

IT specialists are working to resolve the problem as quickly as possible, a statement from the trust says.

 

Also affected is Derbyshire Community Health Services NHS Trust which says it has shut down all of its IT systems following a "secure system attack".

 

A GP from a surgery in York said: "We received a call from York CCG [Clinical Commissioning Group] around an hour ago telling us to switch off all of our computers immediately.

 

"We have since remained open, and are dealing with things that can be dealt with in the meanwhile."

 

Meanwhile, Blackpool Hospitals NHS Trust has asked people not to attend A&E unless it was an emergency because of computer issues.

 

But the NHS in Wales said it had a separate IT system and had not been affected by the cyber attack.

 

http://www.bbc.co.uk/news/health-39899646

Replies sorted oldest to newest

El Loro posted:
Baz posted:

I saw that By the way El Loro .....I had one of those scam phone HMRC calls today ....the recorded message one ....guess what ...they are going to sue me 

Yes, that's definitely a scam

Yes ....I checked it out on web......and apparently this particular recoded message one  is targeting  older people  ....to which my 74 year old husband quipped ..* well that lets me out * 

Baz
Last edited by Baz

A massive ransomware campaign appears to have attacked a number of organisations across Europe.

 

Screenshots of a well known program that locks computers and demands a payment in Bitcoin have been shared online by parties claiming to be affected.

 

There have been reports of infections in the UK, Spain, Italy, Portugal, Russia and Ukraine.

 

It is not yet clear whether the attacks are all connected.

 

One cyber-security researcher tweeted that he had detected 36,000 instances of the ransomware, called WannaCry and variants of that name.

 

"This is huge," he said.

 

The UK's National Health Service (NHS) was also hit by a ransomware attack and screenshots of the WannaCry program were shared by NHS staff.

 

It is not yet clear if the attacks are connected.

 

A number of Spanish firms were among the apparent victims elsewhere in Europe.

 

Telecoms giant Telefonica said in a statement that it was aware of a "cybersecurity incident" but that clients and services had not been affected.

 

Power firm Iberdrola and utility provider Gas Natural were also reported to have suffered from the outbreak.

 

There were reports that staff at the firms were told to turn off their computers.

El Loro
Baz posted:
El Loro posted:
Baz posted:

I saw that By the way El Loro .....I had one of those scam phone HMRC calls today ....the recorded message one ....guess what ...they are going to sue me 

Yes, that's definitely a scam

Yes ....I checked it out on web......and apparently this particular recoded message one  is targeting  older people  ....to which my 74 year old husband quipped ..* well that lets me out * 

 Flipping hell, what utter dirtbags they are Baz

Lucky you were cool calm and collected about it... and you and your hubby could even joke about it afterwards 

Roger the Alien

Reporting Scotland have just said that 6 Scottish Health Boards (NHS Lanarkshire being one of them) have reported that they have experienced some knock-on effects from the English NHS attacks.

 

Our office had some problems, but as they were much the same as what we often experience, we didn't do much more than shrug our shoulders. However, given what the news reports are saying, our problems today could well be because of these attacks and after effects!

Extremely Fluffy Fluffy Thing
Saint posted:

One ponders how on earth people coped before poota's were around.

 

Don't come into A&E unless it's a real emergency??

Can the NHS not fix a broken leg without a laptop???

The problem is that part of the point of moving to a digital system is so that you don't have the cost and hassle of maintaining paper data (patients' medical records, in this case). The downside of that is that if anything goes wrong, you can't restore those paper records easily, if at all.

 

And yes: doctors have been resorting to pen and paper during the current attack.

Eugene's Lair
Jen-Star posted:

Apparently It was down to a bug in window 10 that was patched in March, it would appear NHS and others affected didnt update and patch it... Or so I've just been told 

I'm not so sure about that, Jen. My understanding is that much of the NHS is still running XP.

 

From the Register article I quoted previously:

"The security hole has been patched for modern Windows versions, but not WindowsXP – and the NHS is a massive user of the legacy operating system."

 

Eugene's Lair
Last edited by Eugene's Lair
Eugene's Lair posted:
Jen-Star posted:

Apparently It was down to a bug in window 10 that was patched in March, it would appear NHS and others affected didnt update and patch it... Or so I've just been told 

I'm not so sure about that, Jen. My understanding is that much of the NHS is still running XP.

 

From the Register article I quoted previously:

"The security hole has been patched for modern Windows versions, but not WindowsXP – and the NHS is a massive user of the legacy operating system."

 

Ah yes, that makes sense. Mrjen just said it was the bug we patched in March so we're safe.... I made the rest up in my head ïŋ―ïŋ―

Jen-Star
Eugene's Lair posted:
Jen-Star posted:

Apparently It was down to a bug in window 10 that was patched in March, it would appear NHS and others affected didnt update and patch it... Or so I've just been told 

I'm not so sure about that, Jen. My understanding is that much of the NHS is still running XP.

 

From the Register article I quoted previously:

"The security hole has been patched for modern Windows versions, but not WindowsXP – and the NHS is a massive user of the legacy operating system."

 

They were warned....outdated systems and no longer covered 

FM
Eugene's Lair posted:
Jen-Star posted:

Apparently It was down to a bug in window 10 that was patched in March, it would appear NHS and others affected didnt update and patch it... Or so I've just been told 

I'm not so sure about that, Jen. My understanding is that much of the NHS is still running XP.

 

From the Register article I quoted previously:

"The security hole has been patched for modern Windows versions, but not WindowsXP – and the NHS is a massive user of the legacy operating system."

 

Our computers run Windows 7, but that doesn't mean that other boards do. The news has just said that only 3 boards in Scotland HAVEN'T been affected. In most areas it is only GP surgeries that have been hit, but in Lanarkshire all three hospitals have been hit as well!

 

God knows what it'll be like when we go back on Monday!

Extremely Fluffy Fluffy Thing
Last edited by Extremely Fluffy Fluffy Thing

For Windows operating system users, provided you keep your computer up to date with Microsoft updates, your computer should be safe from this attack unless you are still using Windows XP or older versions.

 

You can check via Control Panel - Windows Update - View Update History to see if that inlcudes March 2017 Security Monthly Quality Rollup for your version of Windows,  or Cumulative Security Update.

El Loro
Last edited by El Loro
El Loro posted:

Niissan's Sunderland plant has been affected:
http://www.bbc.co.uk/news/uk-england-39906534

Places all over the world apparently.

 

Gregor Peter‏ @L0gg0l 14h

The ransomware virus has spread to Deutsche Bahn computers, appears on train station screens (via )

 
 
As some of you may know, my work is related to the rail industry, so I'm expecting my company's span filters to be working overtime this weekend...
Eugene's Lair
Extremely Fluffy Fluffy Thing posted:

I think our IT guys run a back up every weekend, or possibly every night, but the number of times we get a message to say it failed is amazing!

Unfortunately a lot's going to depend on the details of the backup policy and its implementation.

 

It's the same with security updates: in theory, Systems post-XP should be patched, but in practise many people have been slow to do so...

 

Speaking personally, my company's backup tool seems to be fine for my own day-to-day work, but I've colleagues who've had big problems with it. My own problems have been down to more systems-related data, which even IT assumed was being included in the backup process, but wasn't in practise.

Eugene's Lair
Last edited by Eugene's Lair

Some more background info, courtesy of The Register:

74 countries hit by NSA-powered WannaCrypt ransomware backdoor: Emergency fixes emitted by Microsoft for WinXP+/wannacrypt_ransomware_worm/

 

Basically, this all goes back to the theft of a couple of spying tools developed by the US  National Security Agency (NSA) - Eternalblue and Doublepulsar. The Wannacrypt ransomware worm currently doing the rounds is developed from Eternalblue. What's not getting as much publicity at the moment is that it's also installing Doublepulsar - a "backdoor" access tool that allowed the NSA - and presumably now other criminals - to remotely control infected machines.

 

 

Final words from The Register:

If you haven't been infected, make sure your security patches are up to date. Kill off SMBv1 at the very least, and block access to it from outside your network. The exploits the malware uses have already been patched, and there's no excuse for getting caught out as a private user. It's understandable that IT managers with annoying corporate policies and heavy workloads have been forced to hold back patches, or are unable to apply them. If you can update your installations, drop everything and get patching.

And we'd sure appreciate it if you could stop clicking on attachments from unknown parties, too. ÂŪ

Eugene's Lair
Last edited by Eugene's Lair

I was enjoying a nice day out on Saturday, so I'm still catching up with the fallout from this (and no doubt that will continue when I return to work tomorrow...   ).

 

Official advice from Microsoft (includes links to security updates for old systems):

Customer Guidance for WannaCrypt attacks

 

Blog by MalwareTech, the guy who inadvertently activated the malware's "kill switch":

How to Accidentally Stop a Global Cyber Attacks

 

It's (unsurprisingly) rather technical, but readable and interesting nonetheless. It also helps correct some of the media misreporting during all the panic and confusion. MalwareTech is not an amateur, but an information security professional: his job is to track and stop malware,  thus assisting victims and law enforcement. He just happened to be on holiday at the time (his boss has given him another week off to make up for the lost break!).

 

Also, it looks like the "kill switch" wasn't actually an intentional "kill switch" (self-destruct mechanism) after all: current thinking is that it was a badly-engineered attempt by the bad guys to try to prevent the good guys analysing the malware. In theory, the bad guys' thinking was valid (and has been done before), but in practise its poor implementation  provided the good guys with a simple way of stopping it altogether (even if they didn't initially realise it).

Eugene's Lair
Last edited by Eugene's Lair
Eugene's Lair posted:

I was enjoying a nice day out on Saturday, so I'm still catching up with the fallout from this (and no doubt that will continue when I return to work tomorrow...   ).

 

Official advice from Microsoft (includes links to security updates for old systems):

Customer Guidance for WannaCrypt attacks

As EL's post says the above link includes links to patches for older versions of Windows including Windows XP. Microsoft have taken this rare step due to the widespread problems. Micosoft also says that Windows 10 users were not targeted in Friday's attack.

El Loro
El Loro posted:
Eugene's Lair posted:

I was enjoying a nice day out on Saturday, so I'm still catching up with the fallout from this (and no doubt that will continue when I return to work tomorrow...   ).

 

Official advice from Microsoft (includes links to security updates for old systems):

Customer Guidance for WannaCrypt attacks

As EL's post says the above link includes links to patches for older versions of Windows including Windows XP. Microsoft have taken this rare step due to the widespread problems. Micosoft also says that Windows 10 users were not targeted in Friday's attack.

I'm on 8.1 but I keep it updated as soon as they come out    Usually every second Wednesday in the month unless it's something that is urgent 

FM
Extremely Fluffy Fluffy Thing posted:

2 more have appeared!

Make sure you reboot your machine to fully complete any updates, and then check that there aren't any other updates pending.

I find it a good idea to do the same thing when manually updating my anti-virus software: do an update, then keep attempting to update again until it comes back with a "not required" message (or equivalent).

 

(As an illustration: I've just gone and attempted a manual update to my anti-virus software, and although it last did an automatic update only 4 hours ago, there were 4 updates waiting!  I think we can presume that the anti-virus guys are being kept very busy at the moment...   )

Eugene's Lair

Not too surprisingly when we got into work this morning there were notices on all the computers saying "DO NOT SWITCH ON!"

 

Some folk got their computers back mid-m0rning, but I didn't get mine back until mid-day and even then it was a bit unstable and all its functions weren't readily available. There were workarounds to access some apparently 'missing' stuff, but it was a real pain!

Extremely Fluffy Fluffy Thing
Extremely Fluffy Fluffy Thing posted:

Not too surprisingly when we got into work this morning there were notices on all the computers saying "DO NOT SWITCH ON!"

 

Some folk got their computers back mid-m0rning, but I didn't get mine back until mid-day and even then it was a bit unstable and all its functions weren't readily available. There were workarounds to access some apparently 'missing' stuff, but it was a real pain!

Eugene's Lair
Eugene's Lair posted:

Interesting comparison...

Sophos are a major software security company, who have the NHS amongst their clients. Here are screen shots of how Sophos publicly portrayed their relationship with the NHS before (top) and after (bottom) the WannaCrypt attack:

That's a bit worrying - our company (some months ago) asked if we'd mind installing Sophos on our home computers to maintain security of the company system (we'll often log in from home)   I've been relying on that as an a/v - maybe i should get something else?

Kaffs
Kaffs posted:
Eugene's Lair posted:

Interesting comparison...

Sophos are a major software security company, who have the NHS amongst their clients. Here are screen shots of how Sophos publicly portrayed their relationship with the NHS before (top) and after (bottom) the WannaCrypt attack:

That's a bit worrying - our company (some months ago) asked if we'd mind installing Sophos on our home computers to maintain security of the company system (we'll often log in from home)   I've been relying on that as an a/v - maybe i should get something else?

I've not used Sophos products before, but they're supposed to have a good reputation, and I've used their guides in the past for Facebook settings, etc.

 

The main point about these "before and after" shots is that they were essentially making claims of 100% security, which simply isn't realistic and may well have led to complacency. General feeling seems to be that in this case, they've over-sold their product and underestimated the problem.

 

The full Register article I got this from can be found here.

Eugene's Lair
Last edited by Eugene's Lair

A hacking group closely tied to North Korea was behind the massive WannaCry attack earlier this month, security company Symantec says.

 

The way the attack was set up made it "highly likely" that the Lazarus group was responsible, it said.

 

Lazarus has been blamed for a 2014 attack on Sony and the theft of $81m (ÂĢ62m) from Bangladesh's central bank.

 

In those attacks, the group is believed to have worked on behalf of North Korea's government.

http://www.bbc.co.uk/news/technology-40010996

El Loro

Add Reply

×
×
×
×
Link copied to your clipboard.
×
×