This week, Hacking Healthcare™ briefly looks at the evolving cyber incident impacting London. We breakdown what has been reported so far, examine the long list of cascading effects, and then outline how incidents like this come at a time when the political landscape could shift dramatically and lead to new policy approaches.
As a reminder, this is the public version of the Hacking Healthcare blog. For additional in-depth analysis and opinion, become a member of H-ISAC and receive the TLP Amber version of this blog (available in the Member Portal.)
PDF Version:
TLP WHITE - 6.17.2024 -- Hacking Healthcare™
Text Version:
Welcome back to Hacking Healthcare™.
London Cyberattack Highlights Cyber Risk As Elections Loom
Earlier this month, it was reported that Russian-based hackers had successfully launched a cyberattack impacting several major London hospitals. The event is still unfolding and it will likely take months to fully assess the scope of the impact, but there is a lot that is noteworthy and worth addressing at the moment. Let’s break down what we know so far and what lessons and takeaways might be gleaned.
What Happened?
Synnovis is a self-described “pathology partnership between Guy’s and St Thomas’ NHS Foundation Trust and King’s College Hospitals NHS Trust, and SYNLAB, Europe’s largest provider of medical testing and diagnostics.”[i] In addition to their direct relationship with each other, their operations impact “GP services across Bexley, Greenwich, Lewisham, Bromley, Southwark and Lambeth boroughs.”[ii] However, the full list of healthcare entities that rely on Synnovis has yet to be determined, but they include entities as far as the Portsmouth Hospitals University NHS Trust.[iii]
On June 4, Synnovis publicly reported that they had become the victims of a ransomware attack that had “affected all Synnovis IT systems, resulting in interruptions to many of our pathology services.”[iv] Synnovis’ public statement acknowledged reporting the incident to “law enforcement and the Information Commissioner,” as well as “working with the National Cyber Security Centre and the Cyber Operations Team.”[v]
According to Ciaran Martin, the former chief executive of the National Cyber Security Centre (NCSC), it is believed that the Russian cybercriminal group Qilin is responsible for the attack.[vi] He outlined his belief that Qilin was likely looking for a payout and designed the attack to cause enough hurt to force a payout, but may not have been aware of the magnitude of the disruption they appear to have caused.[vii]
Although no additional update has been provided, news reports have continued to highlight the evolving situation. We explore this incident in more detail, including trends and takeaways in our Action & Analysis section.
Action & Analysis
**Included with Health-ISAC Membership**
Upcoming International Hearings/Meetings
- – EU
- – No relevant meetings at this time
- – US
- – No relevant meetings at this time
- – Rest of World
- – No relevant meetings at this time
[xix] For those interested in the data integrity considerations, be on the lookout for the Health-ISAC’s After Action Report from the recently completed 2024 Americas Hobby Exercise.