Opening of email attachment led to the Irish Health Service cyber attack, report finds

The opening of a malicious Microsoft Excel file attached to a phishing email led to the cyber attack that crippled the Irish national health service earlier this year, according to a report on the incident published on Friday.

The file was opened at a HSE workstation on March 18th, with the email having been sent to the “patient zero workstation” two days earlier.

Over the coming eight weeks, a number of “alerts” were raised within the health service that the IT system might be compromised, but the significance of the alerts was not identified at the time.

The ransomware that was introduced into the system was “detonated” on May 14th, leading to an immediate crisis across the health service.

At a press briefing prior to the publication of the report, HSE chief executive Paul Reid said a high proportion of the organisations that are subjected to a cyber attack are “re-hit” and that actions have and are being taken to mitigate the risk to the service.

The response to the alerts that were raised did not involve the response that should have occurred, he said.

The Department of Health, and an unidentified hospital, took steps prior to May 14th that mitigated the effect of the attack on their systems, the briefing was told.

The report does not deal with the issues of a ransom or the location of the criminals behind the attack, but the Government said at the time no ransom would be paid, and a number of observers have said the criminal gang responsible is mostly likely based in Russia.

The report noted the staff in the health service showed “dedication and effort” in response to the crisis with individuals across the HSE and elsewhere in the health system responding in a way that illustrated they are “resilient, respond quickly, and have an ability to implement actions and workarounds” in times of emergency.

It noted the HSE is the largest employer in the State and uses more than 70,000 devices, such as personal computers and laptops.

New-school security awareness training can enable your employees to recognize social engineering tactics so they can thwart phishing attacks.

With thanks to the Irish Times. The full story is here: https://www.irishtimes.com/news/crime-and-law/opening-of-email-attachment-led-to-hse-cyber-attack-report-finds-1.4752043

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

Here’s how it works:

• Immediately start your test for up to 100 users (no need to talk to anyone)
• Select from 20+ languages and customize the phishing test template based on your environment
• Choose the landing page your users see after they click
• Show users which red flags they missed, or a 404 page
• Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
• See how your organization compares to others in your industry

PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW