Penetration Test Report (PwC): conti cyber attack on the hse full report

Conti cyber
attack on
the HSE
Independent Post Incident Review
Commissioned by the HSE Board in conjunction
with the CEO and Executive Management Team
03 December 2021
Redacted
Important Notice
This document has been prepared only for the
Health Services Executive (“HSE”) and solely for the
purpose and on the terms agreed with the HSE in our
engagement letter dated 21 June 2021, as amended
on 6 August 2021. We accept no liability (including
for negligence) to anyone else in connection with this
document.
The scope of our work was limited to a review of
documentary evidence made available to us and
interviews with selected HSE personnel, CHOs,
hospitals and third parties relevant to the review. We
have taken reasonable steps to check the accuracy
of information provided to us but we have not
independently verified all of the information provided
to us relating to the services.
A significant volume of documentation was provided
to us throughout the course of the review. We
have limited our review to those documents that
we consider relevant to our Terms of Reference.
We cannot guarantee that we have had sight of all
relevant documentation or information that may be
in existence and therefore cannot comment on the
completeness of the documentation or information
made available to us. Any documentation or
information brought to our attention subsequent to
the date of this report may require us to adjust our
report accordingly.
2 | PwC Independent Post Incident Review 2021 © 2021 PwC. All rights reserved.
Contents
Executive summary 1
1
Learnings 11
2
Introduction and background 14
2.1 Overview of the ransomware cyber attack 15
2.2 Background to this post incident review 22
2.3 Scope of our review 22
2.4 Our review approach 22
2.5 Structure of our report 26
3
Timeline of the Incident 27
4
Key recommendations and findings 34
4.1 Strategic actions 35
4.2 Immediate tactical actions 41
5
Focus areas - key findings and recommendation 44
5.1 Focus area 1 - review of technical investigation and response 46
5.2 Focus area 2 - review of organisation wide preparedness and 66
strategic response
5.3 Focus area 3 - preparedness of the HSE to manage cyber 93
risks
3 | PwC Independent Post Incident Review 2021 © 2021 PwC. All rights reserved.
Appendices 102
A. Scope of work 103
B. List of interviews 105
C. Key artefacts 106
D. List of key recommendations 110
E. Focus area 1 - detailed technical timeline 127
F. Focus Area 2 - detailed organisational timeline 138
G. Focus area and key recommendation mapping 142
H. HSE Risk assessment tool 144
I. Glossary and terms 147
4 | PwC Independent Post Incident Review 2021 © 2021 PwC. All rights reserved.
The Board,
HSE,
Dr Steevens’ Hospital,
Dublin 8, Ireland
03 December 2021
Subject : Post Incident Review into the Ransomware Cyber Attack
Dear Chair,
The Board of the Health Service Executive (“HSE”) in conjunction with the Chief Executive Office (“CEO”) and
the Executive Management Team (“EMT”) have requested an independent review into the recent ransomware
cyber attack (the “Incident”) and the circumstances surrounding this exfiltration of data from the HSE’s
Information Technology (“IT”) systems. The purpose of the review is to:
- Urgently establish the facts in relation to the current preparedness of the HSE in terms of both its
technical preparedness (Information and Communications Technology (“ICT”) systems, cyber and
information protections) and its operational preparedness (including Business Continuity Management
planning) for a strategic risk of this nature.
- Identify the learnings from this Incident to identify improvements to the HSE’s preparedness for
and response to other major risks including immediate risks and incidents that cause major business
disruption.
- Share those learnings within the HSE and externally with State and non-State organisations to inform
their future preparedness.
Save as described in our contract or as expressly agreed by us in writing, we accept no liability (including for
negligence) to anyone else or for any other purpose in connection with this report.
The subject matter and volume of information we reviewed as part of this process has been complex and
significant in nature. Similarly, the timeline against which the review has been conducted has been challenging
and has only been achieved with the cooperation of the many stakeholders involved, for which we are
appreciative.
Yours faithfully,
PricewaterhouseCoopers
PricewaterhouseCoopers, One Spencer Dock, North Wall Quay, Dublin 1 Ireland T: +353 (0) 1 792 6000, F: +353 (0) 1 792 6200, www.pwc.ie
Feargal O’Rourke (Managing Partner - PricewaterhouseCoopers Ireland)
Olwyn Alexander Andy Banks Amy Ball Paul Barrie Brian Bergin Alan Bigley Fidelma Boyce Donal Boyle Ciara Breslin Sean Brodie Paraic Burke Damian Byrne
Robert Byrne Pat Candon John Casey Mary Cleary Marie Coady Siobhán Collier Joe Conboy Keith Connaughton Mairead Connolly Tom Corbett
Thérèse Cregg Garrett Cronin John Daly Richard Day Elizabeth Davis Fíona de Búrca Jean Delaney Liam Diamond John Dillon Ronan Doyle John Dunne Kevin
Egan Colin Farrell Ronan Finn Laura Flood Ronan Furlong Fiona Gaskin Denis Harrington Aoife Harrison Harry Harrison Feilim Harvey Alisa Hayden Olivia
Hayden Mary Honohan Gareth Hynes Ken Johnson Patricia Johnston Paraic Joyce Andrea Kelly Ciarán Kelly Colm Kelly Joanne P. Kelly Shane Kennedy Susan
Kilty Fiona Kirwan David Lee Brian Leonard Gillian Lowth Vincent MacMahon Ronan MacNioclais Pat Mahon Declan Maunsell Kim McClenaghan
Dervla McCormack Michael McDaid Enda McDonagh Declan McDonald Shane McDonald John McDonnell Gerard McDonough Ilona McElroy Mark McEnroe
David McGee Deirdre McGrath Ivan McLoughlin James McNally Stephen Merriman Pat Moran Paul Moroney Yvonne Mowlds Ronan Mulligan Declan Murphy
John Murphy Andy O’Callaghan Colm O’Callaghan Jonathan O’Connell Aoife O’Connor Paul O’Connor Paul M O’Connor Emma O’Dea Doone O’Doherty
Kieran O’Dwyer Munro O’Dwyer Mary O’Hara Irene O’Keeffe John O’Leary John O’Loughlin Ger O’Mahoney Liam O’Mahony Darren O’Neill Tim O’Rahilly
Feargal O’Rourke Padraig Osborne Sinead Ovenden Ken Owens Keith Power Nicola Quinn Aoife Reid Peter Reilly Susan Roche Mary Ruane Stephen Ruane
Gavan Ryle Emma Scott Colin Smith Ronan Somers Billy Sweetman Yvonne Thompson Paul Tuite David Tynan Joe Tynan Ken Tyrrell Stephen Walsh
Located at Dublin, Cork, Galway, Kilkenny, Limerick, Waterford and Wexford.
PricewaterhouseCoopers is authorised by Chartered Accountants Ireland to carry on investment business.
5 | PwC Independent Post Incident Review 2021 © 2021 PwC. All rights reserved.
Executive summary disruption immediately occurred and many healthcare
professionals had to revert to pen and paper to
continue patient care. Healthcare services across
Background
the country were severely disrupted with real and
immediate consequences for the thousands of people
The Health Service Executive (“HSE”) is a large who require health services every day.
geographically spread organisation which provides all
of Ireland’s public health services through hospitals Normal communication channels, both at HSE’s
and communities across the country. The HSE national centre and within operational services
consists of approximately 4,000 locations, 54 acute were also immediately lost. This included email
hospitals and over 70,000 devices (PCs, laptops, and networked phone lines. Staff switched to
etc). Services are provided through both community communicating using mobile and analogue phones;
delivered care and care provided through the hospital fax; and face to face meetings.
system as well as the national ambulance service.
Corporate services and other services that support The aim of the Attacker was to disrupt health services
healthcare delivery are provided through the national and IT systems, steal data, and demand a ransom for
centre. the non-publication of stolen data and provision of a
tool to restore access to data they had encrypted.
The HSE is