Malware 'stolen from the NSA' cripples the NHS

NHS hit by a major cyber attack and criminals have taken control of computers

Read more on NHS Cyber attack

Operations have been cancelled as attack affects 37 NHS Trusts in England

Hospitals can't do MRI and CT scans and warn patients not to come to A&E

Some NHS Trusts have turned off their IT systems and are using pen and paper


Hospitals are held to ransom, operations cancelled and A&E patients turned away in global cyber attack using weapon released by 'Shadow Brokers'



Hospitals across Britain were paralysed last night after cyber hackers held the NHS to ransom in an unprecedented global attack. Countless operations were cancelled and patients were turned away as almost 40 hospital trusts (right) and hundreds of GP surgeries were locked out of their computer systems with a pop-up message (main). NHS staff pleaded with patients to stay away from A&E except in an emergency, and ambulances were diverted away from hospitals struggling to cope. Anthony Brett (bottom left) told last night how his long-awaited operation was cancelled because of the cyber attack as he waited to go into the operating theatre. Emma Simpson (top left) took her son, Sebastian, to Whipps Cross University Hospital in Leytonstone, east London, for an X-ray on his broken toe but was sent home because of the cyber attack as police (bottom right) attended hospitals. Experts say the cyber attack used code developed by the US National Security Agency (inset) which was leaked online by a mysterious group called the Shadow Brokers.

This map released by cybersecurity experts, shows the impact of the ransomware around the world - with affected countries shown in orange and red. Russia is thought to be the worst affected

Police at Southport Hospital following the NHS cyber attack this afternoon

East and North Herts NHS Trust issued this warning to patients on their website

Cyber attack Q&A: What happened, why are hospitals vulnerable and didn't the NHS know it was at risk? 
Cyber criminals have unleashed their most dangerous weapon on the NHS – 'ransomware'.

 CHIEF REPORTER SAM GREENHILL explains.

What happened?

At 1.30pm yesterday, NHS computers came under massive attack from cyber criminals threatening to destroy patient files unless they received a ransom. Staff found computers locked, with a warning that files had been scrambled to make them unintelligible. It gave a one-week deadline to pay up and recover the data – or see it deleted. In response, dozens of NHS Trusts shut down their IT systems – cutting off phone lines and medical machinery.

Who is affected?

At least 37 NHS Trusts have been attacked by the 'Wanna Decryptor' ransomware virus.

What is ransomware?

A malicious virus which infects devices and holds information hostage until a ransom is paid. It can be triggered by a staff member clicking on a link in a malicious email that may look innocent. The virus lies low until it is activated, either by a timer or remotely by the cyber gang.

What are the cyber criminals demanding?

The ransom note warns: 'Do not waste your time. Nobody can recover your files without our decryption service.' It demands $300 (£230) worth of the digital currency bitcoins – per computer infected – within three days or the price doubles. If the ransom is not paid by Friday, the files will be wiped 'forever'.

What are bitcoins?

The controversial web currency, dubbed 'geek's gold', recently overtook the value of an ounce of gold. One bitcoin is worth £1,367. They are not physical coins and only exist in cyberspace. Users can remain anonymous, which is why they are often used for illegal activity.
Why are hospitals vulnerable?

Many NHS computers are running very out-of-date software which can have serious security flaws. At least ten health trusts still rely on the Windows XP operating system, released in 2001.
Why target hospitals?

This is viewed as 'unethical' by some hackers, but hospitals are increasingly being seen as easy targets who will pay up quickly because getting systems running is a matter of life and death.
Who are the prime suspects?

Sources said the attack pointed to a criminal network rather than a state. Security insiders have vowed that the Government will not pay a ransom. Hackers in Russia, China, Ukraine and Taiwan have been pioneering ransomware lately.

Didn't the NHS know it was at risk?

Almost a third of NHS trusts have been infected by ransomware, according to the latest edition of the British Medical Journal. Experts have been warning about the risk to the NHS for years. Last year the Papworth Heart Hospital in Cambridge was attacked, but fortunately, a backup had just been completed of its files, meaning the system could be rebooted and the data was safe. The IT director said: 'We were very, very lucky.'

How can attacks be prevented?

Software should be kept up to date. Anti-virus programs can also be used to 'clean' malicious software from a computer.