British hospitals hit by cyberattacks still battling to get systems back online

Updated Both National Health Service trusts that oversee the various hospitals hit by separate cyberattacks last week have confirmed they're still in the process of restoring systems.

NHS Wirral University Teaching Hospital, which also looks after the nearby Clatterbridge and Arrowe Park hospitals, downgraded its "major incident" to a "business continuity incident" but is still working to bring hospital systems back online.

A spokesperson said in the trust's first statement in nearly a week: "Some services will continue to be affected this week as systems are restored. Anyone with an outpatient appointment is advised to come to their appointment.

"Emergency treatment is being prioritized but there are still likely to be longer than usual waiting times in our Emergency Department and assessment areas."

NHS Wirral said it reverted to pen and paper operations following the attack last week, but the intrusion hasn't yet been claimed by a known crime group.

'Digital gateway service' was the point of intrusion

The same can't be said for the attacks on Liverpool hospitals. INC Ransom took credit for these, which have attracted an overwhelmingly angry reception from onlookers, for the most part due to the impact on Alder Hey Children's Hospital.

Per an updated statement, a spokesperson for Alder Hey Children's Hospital NHS Trust, which also oversees Liverpool Heart and Chest Hospital and Royal Liverpool University Hospital, confirmed the source of the intrusion as an unspecified digital gateway service.

"Criminals gained unlawful access to data through a digital gateway service shared by Alder Hey and Liverpool Heart and Chest Hospital. This has resulted in the attacker unlawfully getting access to systems containing data from Alder Hey Children's NHS Foundation Trust, Liverpool Heart and Chest Hospital, and a small amount of data from Royal Liverpool University Hospital.

"We have launched an investigation which is still ongoing to determine the full facts around what data has been obtained unlawfully."

Data allegedly taken from the trust's servers was posted online last week, including what appeared to be the personal details of donors to one of the UK's foremost children's hospitals and its patients.

"The attacker has claimed to have extracted data from impacted systems," the statement added. "Screenshots of data the attacker claims to have taken were published online last Thursday. We are continuing to take this issue very seriously while investigations continue into whether the attacker has obtained confidential data.

• NHS major 'cyber incident' forces hospitals to use pen and paper
• Ransom gang claims attack on NHS Alder Hey Children's Hospital
• Ransomware negotiator weighs in on the extortion payment debate with El Reg
• A tale of 2 casino ransomware attacks: One paid out, one did not

"The investigation into the data may take some time, and there is a possibility that the attacker may publish the data before our investigation is concluded."

Additional updates about the allegedly stolen data will be provided as soon as the trust is able to, it said, in line with the rules imposed by the Information Commissioner's Office.

Alder Hey said it has made progress to secure the systems that INC Ransom's crooks targeted and ensuring their access continues to be blocked, although this work is ongoing with the help of the National Crime Agency.

The process of reconnecting the targeted systems is still to be completed, but unlike the trust's counterparts over the Mersey in Wirral, all hospital services remain unaffected and patients are advised to continue attending appointments as scheduled.

Despite calls made from essentially all corners of the infosec industry to stand down the attack, INC Ransom is yet to remove Alder Hey from its data leak site.

The NHS and the UK in general have a longstanding policy to not pay ransom demands. There hasn't been a reported ransom payment from any NHS organization since the WannaCry incident of 2017, so it's unlikely that INC, or whoever was behind the attacks in Wirral, will receive whatever they're asking for.

And INC should know this already since their affiliates were behind the hit on NHS Dumfries and Galloway earlier this year – another incident for which they weren't paid. ®

Updated to add at 0952 UTC, December 6

Alder Hey Children's Hospital issued another small update this week delivering big news for those watching the ongoing cyberattack against it.

It announced on Thursday afternoon that after reviewing the data stolen by INC Ransom, it doesn't believe any of it relates to children or young people.

The update will provide welcome relief to worried parents that their sick children's medical details won't be made public by a band of lowlifes.

The Registerreviewed the limited sample of stolen data posted by the crooks last week on its data leak site, finding that Alder Hey's latest claims are consistent with the content of the data.

The limited amount of data made public appears to relate to adults, their medical cases at the other hospitals affected by the incident, and hospital finances.