Support Key Learnings Following the Ransomware Attack on Irish Healthcare Home > News > Key Learnings Following the Ransomware Attack on Irish Healthcare By Louise O’ Sullivan, ICT Security Services Manager at HEAnet In May 2021, Ireland was subjected to an unprecedented ransomware attack on its full healthcare system. The HSE (Health Service Executive) systems were targeted with Conti ransomware which saw many of the HSE’s systems encrypted. This type of ransomware is designed to be operated by an attacker, rather than through an automated process. It is thought the attack originated from a phishing email. This attack caused significant levels of disruption for the HSE necessitating many hospitals having to revert to pen and paper, with the majority of appointments being cancelled. It was reported that there is the potential that patient, staff or administrative data was compromised. It should be noted that no ransom was paid and a week after the initial attack the decryption key was provided. As the attack was so large the NCSC of Ireland, An Garda Síochána and the army were involved in the response. As this attack affected so many people within Ireland, cybersecurity became the new topic of conversation, even more so as this attack was happening during the current COVID-19 pandemic. We at HEAnet found our clients requirements for awareness training on ransomware increase drastically within the months that followed. Following this attack, the ICT Security Services team at HEAnet observed the following key learnings: Real-life examples Continued Security Awareness Training using real-life examples relevant to the industry you work in really informs the attendees. Phishing emails It is imperative to know what phishing emails are and the key elements that will identify this type of email. This is one of the main ways in which ransomware enters an organisation. Ransomware playbook The importance of implementing an incident response plan including a ransomware playbook. This playbook is a valuable resource as it will determine the steps to follow in the attempt to recover any affected system of ransomware. Understanding ransomware It is also extremely important for any institution to understand how ransomware can enter a network. Below is an outline of the common approach a ransomware attack may take. Distribution Campaign Attackers use techniques like phishing emails and weaponised websites to trick or force users to download a dropper which is the beginning of the infection. Malicious Code Infection The dropper contacts the attacker’s malicious site and downloads an executable that installs the ransomware itself. Malicious Payload Staging The ransomware sets itself up, it does this by embedding itself in the system. Scanning The ransomware searches for content to encrypt, both on the local computer and any accessible network resources. Encryption Files are encrypted, the ransomware typically attacks backup files and folders so that they cannot be used to recover the data. Payday A ransom note is generated, the victim would receive instructions on how to pay the ransom (usually in bitcoin). Victims are usually given a few days to pay the ransom after which the price will increase. https://www.exabeam.com/wp-content/uploads/2017/07/Exabeam_Ransomware_Threat_Report_Final.pdf Based on our observations, the ICT Security Service at HEAnet has now included more information around ransomware and its prevention in Security Awareness Training. The service is also currently holding a number of workshops on ransomware from a technical perspective. To conclude, the healthcare system ransomware attack in Ireland has brought immense focus on cybersecurity not only for the government but all businesses, colleges and organisations within Ireland. It highlights the need for us to try and work in a more proactive capacity rather than a reactive approach to cybersecurity and its threats. Other References: https://www.siliconrepublic.com/enterprise/hse-cyberattack-explainer-conti-ransomware https://www.thejournal.ie/hse-ransomware-attack-2-5440082-May2021/ Author Louise O’Sullivan Louise is the ICT Security Services Manager at HEAnet; Ireland’s National Education and Research Network for the past four years. She holds both a degree and Masters from NUI, Galway and is a certified CISA auditor and Lead ISMS Implementer. Her background is primarily in IT Audit, Security consulting and Cyber Security working in companies including Deloitte, AON and PwC. Article originally posted on connect.geant.org Previous Post Wexford Libraries introduce eduroam Wi-Fi to support students Next Post WIN a high spec laptop and study on the go Recent Posts WIN a high spec laptop and study on the go October 26, 2021 Key Learnings Following the Ransomware Attack on Irish Healthcare October 5, 2021 Wexford Libraries introduce eduroam Wi-Fi to support students October 4, 2021 Cyber Security Month 2021 October 1, 2021 HEAnet and EduCampus, Runners-Up at the Ibec KeepWell Mark™ Awards for 2021 September 3, 2021 Categories Blog (2) News (53) Newsletters (7) Peering (2) Security Updates (6) Telephone: +353-1-660 90 40 General Info: info@heanet.ie Registered in Ireland, No. 275301 CHY No. 12414 CRA No. 20036270 HEAnet CLG 1st Floor, 5 George’s Dock, IFSC, Dublin 1, D01 X8N7, Ireland. View Map Privacy Policy Presskit Terms & Conditions Freedom of Information Support © 2021 HEAnet CLG | Site Credits Cookies Settings By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. Accept All Cookies Cookies Settings