The 2017 WannaCry attack caused havoc. Has enough been done to prepare the system for next time?

Health service insiders fear the NHS will be hit by another cyber-attack similar to the WannaCry ransomware outbreak that caused widespread disruption to hospitals and GP surgeries last year.

Poor leadership, budgetary constraints, deficient IT systems and a lack of qualified staff mean another attack on the health service is inevitable, according to experts at a Guardian event supported by DXC. Guardian technology reporter Alex Hern spoke about the impact of the 2017 WannaCry cyber-attack, and clinicians, cybersecurity specialists, policy advisers and politicians discussed how to best protect NHS IT systems.

Meg Hillier, MP for Hackney South and Shoreditch, and chair of the public accounts committee, which earlier this year described WannaCry as a wake-up call for the NHS, said that as well as a shortage of IT skills in the NHS workforce, there was an issue around leadership. . “A chief executive has a lot of pressures put on them,” she pointed out. “It’s a challenge: what are you going to pay for? You don’t see any particular benefit for patients if you invest in a good IT system – it’s not a big enough issue and not an instant win in a world of winter pressures.” Hillier added that many NHS staff do not trust their IT systems.

Hancock to tell summit of goal to revolutionise NHS with new tech Read more

“I’ll always be terrified that [an attack similar to WannaCry] will happen again. We’re not doing enough [to prevent it] and there’s more we can do,” said Ben Clacy, the director of development and operations at NHS Providers, the membership organisation for NHS acute, ambulance, community and mental health services. “An attack is inevitable,” added Dr David Lee, a practising GP who is also medical director for the UK and Ireland for DXC. Lee said he was worried about how NHS organisations would cope if fending off cyber-attacks became “business as usual rather than a sporadic event”.

The WannaCry cyber-attack in May 2017 led to 19,500 cancelled appointments and left 600 GP surgeries without their IT systems. Eighty-one NHS organisations were affected and five hospitals were forced to divert ambulances. WannaCry ransomware was a new type of malware that travelled from one computer to the next, meaning that a small targeted attack escalated to one capable of taking out an entire healthcare system.

Facebook Twitter Pinterest Meg Hillier, chair of the Commons public accounts committee, and Chris Flynn, head of cyber and security information operations, NHS Digital. Photograph: Louise Bartlett Truslove/The Guardian

A report by the National Audit Office found the attack could have been prevented by basic IT practices. It also discovered that before the attack, NHS Digital carried out cybersecurity assessments at 88 of the 236 health trusts in England. None passed, but the organisation couldn’t force action so large swaths of the NHS were left vulnerable.

Audience member Marc Bolger was working as a neonatal doctor at Barts NHS health trust when the attack hit. He was on holiday at the time but came back a week later to the ensuing chaos. “The entire system was shut down,” he said. “We went back to using paper for a month. It was more of an inconvenience; most departments managed all right. A&E uses the system more – that must have been a pain.” Clinical appointments were also affected, he said.

Panellists at the event agreed that the WannaCry attack highlighted both the best and the worst of the NHS. The health system’s vulnerability in terms of IT was painfully apparent, but so too were the heroic efforts of people at every level in dealing with the attack, according to Lee. After an initial lack of communication and confusion as to what was going on, the way the NHS dealt with the attack was impressive, agreed Clacy.

Participants highlighted areas for improvement as well as the challenges in investing to protect NHS IT systems. Chris Flynn, head of cyber and information security operations at NHS Digital, talked about some of the work that had been happening since the attack. The organisation is setting up a data security programme and has listened to feedback from trusts about the common challenges and vulnerabilities that need addressing, like bringing firewalls up to date, and providing training at a local and board level.

Facebook Twitter Pinterest Eleonora Harwich and Dr David Lee. Photograph: LouiseBartlettTruslove/Louise Bartlett-Trustlove

Sign up for Society Weekly: our newsletter for public service professionals Read more

While all panellists were worried about the possibility of another attack, Eleonora Harwich, director of research and head of digital and tech innovation at Reform, remained hopeful. “A lot of the recommendations that came out of WannaCry are a step in the right direction,” she said, although Harwich also sounded a note of caution: “I wonder if we will eventually work out how to translate recommendations and headline policy into what happens on the ground.”

The panel

Chair: Jane Dudman, public leadership editor, The Guardian

Ben Clacy, director of development and operations, NHS Providers

Chris Flynn, head of cyber and information security operations, NHS Digital

Eleonora Harwich, director of research and head of digital and tech innovation, Reform

Meg Hillier, MP for Hackney South and Shoreditch and chair of the public accounts committee

Dr David Lee, medical director, UK & Ireland, DXC; non-executive director, Shrewsbury and Telford hospital NHS trust