Jeremy Hunt has been accused of ignoring “extensive warning signs” that could have prevented an unprecedented global cyber-attack which has plunged the NHS into chaos.
Hospitals across England and Scotland have been crippled by a global attack that targeted tens of thousands of computers around the world, with around 45 NHS organisations infiltrated by malicious software on Friday.
The NHS was working on Saturday to bring its systems back online after it became the highest-profile victim of the so-called WannaCry attack and faced renewed concern about the strength of its infrastructure.
The National Cyber Security Centre (NCSC) said teams were “working round the clock” in response to the crisis, which resulted in operations being cancelled, ambulances being diverted and documents including patient records made unavailable in England and Scotland. Many hospitals continued to see long delays on Saturday.
The attack hit computers in almost 100 countries on Friday and the effects were still emerging more than 24 hours later, with the Nissan factory in Sunderland and operations of the international delivery service FedEx among those hit.
The shadow health secretary, Jonathan Ashworth, said concerns had been flagged repeatedly about the NHS’s outdated computer systems, which he said had left it vulnerable to the attack. In a letter to Hunt on Saturday, he wrote: “As secretary of state, I urge you to publicly outline the immediate steps you’ll be taking to significantly improve cybersecurity in our NHS. The public has a right to know exactly what the government will do to ensure that such an attack is never repeated again.”
The attack, which is believed to have been based on technology stolen from the National Security Agency in the US, encrypted files in dozens on large companies across Europe and Asia. A ransom note that appeared on users’ screens demanded money in exchange for accessing their PCs.
Microsoft has since released a fix for the XP operating system most vulnerable to the attack. The company had developed a fix for the software, used by most NHS computers, but hadn’t released it until now. The free patch does not remove the malware if already in the computer.
The British prime minister, Theresa May, and NHS Digital said they were not aware of any evidence that patient records had been compromised in the attack. May said: “This is not targeted at the NHS, it’s an international attack and a number of countries and organisations have been affected.”
Amber Rudd, the home secretary, refused to confirm on Saturday morning whether patient data had been backed up, and said the NHS would upgrade its software in the wake of the attack. She said data should be backed up, but would not say whether it actually had been. Rudd chaired an emergency meeting of the government’s Cobra committee on Saturday afternoon.
In a series of pointed questions for the health secretary, Ashworth demanded to know why NHS organisations failed to act on a critical security note from Microsoft two months ago, what resources were being provided to hospitals to alleviate the crisis and what protections against cyber-attacks existed.
Ashworth also urged the government to launch an independent inquiry into the attack and clarify whether patient data had been accessed or compromised.
He said there had been repeated warnings about the vulnerability of the outdated NHS systems, including from the NCSC and the National Crime Agency.
He said many hospitals had been left “extremely vulnerable” to an attack since 2015, when they continued to use an outdated version of Windows after a security package had been stopped. The Guardian reported two years ago that the government had decided not to extend its £5.5m deal with Microsoft to provide support for Windows XP, leaving computers that still ran on the obsolete operating system at risk from hackers.
“NHS trusts have been running thousands of outdated and unsupported Windows XP machines despite the government ending its annual £5.5m deal with Microsoft, which provided ongoing security support for Windows XP, in May 2015,” Ashworth wrote.
“It effectively means that unless individual trusts were willing to pay Microsoft for an extended support deal, since May 2015 their operating systems have been extremely vulnerable to being hacked.”
A freedom of information request in February found a total of 79 English trusts had suffered ransomware attacks since June 2015, he said.
Rudd – not Hunt – replied to Ashworth’s letter on Saturday afternoon. “The malicious actions of the cyber criminals behind this attack have caused considerable distress for those patients who have been affected,” she wrote. “There is no evidence that any patient data has been compromised and the NHS has done brilliantly to manage the disruption.”
“But we must be careful not to characterise this as an attack on our NHS, and it is vital we do not jump to the wrong conclusions. As Europol have said, the scale of this attack is unprecedented and it is affecting a wide range of organisations in almost 100 countries around the globe.
“Today we have learned that Nissan’s plant in Sunderland has been affected, while according to reports others affected around the world include major telecoms firms, utility providers, railways, universities and local authorities.”
In a swipe at Labour, she said: “Should you have any concerns about the security of the Labour party’s own systems, GCHQ stand ready to provide a briefing on how best to minimise the risk of a successful attack.”
The Labour leader, Jeremy Corbyn, said: “What we’ve now got is a bunch of 21st-century highway robbers that have hacked into our NHS and are basically offering protection money to get the information back in order to treat cancer patients or anybody else. It’s unbelievably disgusting and I’ve got nothing but contempt for those people that have done it, and I’m sure all of you would share that.
“But I’m also very angry that in 2014 there was a one-year renewal of the protection system on the NHS systems which was not renewed after that and not renewed the year after that, and so systems are now not upgraded and not protected. As a result, we’ve got this dreadful situation that NHS workers are facing today.
“And so we obviously support our NHS workers, but I tell you this, a Labour government would not leave our NHS’s very vital information systems unprotected. We would protect them.”
