Translate the text from Welsh to English.



 
Ar 17 Mawrth cyhoeddais ddatganiad ysgrifenedig ynghylch yr ymosodiad diogelwch seiber ar Landauer, y cwmni trydydd parti sy’n darparu’r Gwasanaeth Diogelu Rhag Ymbelydredd i Ymddiriedolaeth GIG Felindre ar ran GIG Cymru. Yn sgil yr ymosodiad hwn, cafwyd mynediad anghyfreithlon at wybodaeth bersonol am staff.      
  
Yn y datganiad hwnnw, amlinellais y camau sy'n cael eu cymryd mewn ymateb i'r digwyddiad, ynghyd â'r adolygiadau ehangach a fyddai'n cael eu cynnal o ganlyniad. Rwy'n cyhoeddi'r datganiad ysgrifenedig hwn, fel yr addewais, i roi'r wybodaeth ddiweddaraf gan fod ymchwiliadau’r GIG bellach wedi'u cwblhau.  
  
Yn gyntaf, gallaf gadarnhau bod pob aelod o staff GIG Cymru a gafodd eu heffeithio ac y bu modd eu hadnabod wedi cael eu hysbysu ac wedi cael cynnig cymorth. Roedd y cymorth hwnnw'n cynnwys canllawiau ynghylch monitro eu materion ariannol; dros y ffôn, e\-bost a sesiynau galw heibio; a mynediad rhad ac am ddim at wasanaeth Experian i ymchwilio i statws credyd am ddwy flynedd. Mae byrddau ac ymddiriedolaethau iechyd hefyd wedi tawelu meddyliau staff na chafodd eu heffeithio gan yr ymosodiad, ond a oedd efallai'n poeni am hynny.    
  
Er gwaetha'r ymdrechion sylweddol, mae sawl unigolyn na lwyddwyd i gysylltu â nhw o hyd, gan nad oedd digon o wybodaeth ar gael i'w hadnabod.   
  
Yn ogystal â'r ymchwiliad a gynhaliwyd o fewn Ymddiriedolaeth GIG Felindre, a arweiniodd at adroddiad llawn, gofynnais am sefydlu grŵp i ymchwilio i fynediad diawdurdod at ddata er mwyn adolygu'r digwyddiad a rhoi sicrwydd ar gyfer y dyfodol. Roedd y grŵp hwn yn cynnwys cynrychiolwyr ar ran Llywodraeth Cymru, Gwasanaeth Gwybodeg GIG Cymru ac Ymddiriedolaeth GIG Felindre.   
  
O ganlyniad i waith y grŵp:  
  


* Cynhaliwyd adolygiad o bob system genedlaethol sydd naill ai'n cael eu cynnal neu'n cael eu defnyddio gan ddarparwyr trydydd parti, a gosodwyd mesurau lliniaru er mwyn mynd i'r afael ag unrhyw risgiau yn y dyfodol.
* Ysgrifennodd y Cyfarwyddwr Cyffredinol Iechyd a Gwasanaethau Cymdeithasol a Phrif Weithredwr GIG Cymru at Brif Weithredwyr GIG Cymru i’w hatgoffa o'r angen am fesurau rheoli contractau yn ymwneud â rheoli gwybodaeth a sicrwydd gwybodaeth ar gyfer cyflenwyr trydydd parti.
* Mae cynllun ymateb i ddigwyddiadau seiber Gwasanaeth Gwybodeg GIG Cymru yn cael ei roi ar waith ar gyfer pob digwyddiad diogelwch seiber ar draws Cymru. Bydd hyn yn ffordd o sicrhau bod prosesau safonol yn cael eu dilyn ar draws GIG Cymru yn achos unrhyw ddigwyddiad diogelwch seiber, gan sicrhau bod digwyddiadau yn cael eu hadrodd, eu cyfathrebu a'u huwchgyfeirio’n briodol. Mae'r GIG yn gweithio i sicrhau bod eu cynlluniau ymateb lleol i ddigwyddiadau seiber yn cyfateb i'r templed cenedlaethol.
* Mae grŵp dan arweiniad Gwasanaeth Gwybodeg GIG Cymru ac Uwch\-berchnogion Risg yn adolygu arferion presennol ac yn mynd i gynghori ynghylch datblygiadau pellach. Mae gan bob un o Fyrddau ac Ymddiriedolaethau Iechyd Cymru swyddog ar lefel bwrdd i gyflawni’r swyddogaeth hon fel person sy’n gyfrifol am reoli risg yn ymwneud â gwybodaeth.

  
Mae adolygiad Swyddfa'r Comisiynydd Gwybodaeth yn parhau ac fe fydd y canfyddiadau'n cael eu cyhoeddi yn y man.   
  
Mae'r achos hwn o fynediad diawdurdod at ddata, yn ogystal â'r ymosodiad seiber meddalwedd wystlo diweddar, wedi'n hatgoffa bod angen i ni fod ar ein gwyliadwriaeth, sicrhau ein bod yn cymryd rhagofalon priodol a bod yn barod i ymateb.   
  






Translation:


 
On 17 March, I published a written statement on the cyber security attack on Landauer, the third party company providing the Radiation Protection Service for Velindre NHS Trust, on behalf of NHS Wales, which resulted in some personal information of staff being accessed illegally.  

  

In that statement, I outlined the action being taken in response to the Landauer incident, along with the wider reviews that would be undertaken as a result of it. As I said I would, I am issuing this written statement to provide an update now that NHS  investigations have been completed.  

  

Firstly, I can confirm that all identified affected NHS Wales staff have been notified and offered support. The support included guidance on monitoring their financial affairs; via telephone, email and drop\-in sessions; and, free access to the Experian credit check service for two years. Health boards and trusts have also provided assurance to staff who were not affected by the breach, but who may have been concerned that they were.  

  

Although considerable effort was made, there remain a number of individuals who could not be contacted because there was insufficient detail available to identify them.  

  

In addition to the investigation undertaken within Velindre NHS Trust, which delivered a full incident report, I requested that a data breach review group be established to review the breach and take action to ensure future assurance. This group included representation from Welsh Government, NHS Wales Informatics Service (NWIS) and Velindre NHS Trust.  

  

As a result of the work of the data breach group:  

 


* A review of all nationally hosted systems which are either hosted by, or accessed by, third party providers has been undertaken and mitigating controls have been put in place to address any future risk;


* The Director General for Health and Social Services/ NHS Wales Chief Executive has written to NHS Wales Chief Executives reminding them of the need to have contractual controls in place relating to information governance and information security for third party suppliers;


* The NHS Wales Informatics Service cyber incident response plan is being applied for any cyber security incidents across Wales.  This ensures that standard processes will be deployed across NHS Wales in the event of a cyber security incident, ensuring that incidents are reported, communicated and escalated appropriately.  The NHS is working to align local cyber incident response plans to the national template; and


* A group led by NWIS and Senior Information Risk Owners is reviewing current practice and will advise on further developments. Each Health Board and Trust in Wales now has a board\-level executive fulfilling this function as the person responsible for information risk management.


  

A review by the Information Commissioner’s Office is ongoing and the findings will be published in due course.  

  

This data breach, as well as the recent ransomware cyber attack, has reminded us of the need to remain vigilant, ensure that we take the appropriate precautions and be ready to respond.