Security Shock: Ransomware Attack on Ireland’s Health Service​

​
By Adelina Budulan​


The Story

Ireland’s health service has been disrupted by a “significant ransomware attack”, which prompted the Irish Health Service Executive (HSE) to shut down all of its IT systems (HSE Ireland). The perpetrators have sought ransom in bitcoin, but Ireland has refused to pay, “in line with state policy” (Financial Times). Although the operations of the health service have largely remained functional, medical professionals have been unable to access patient records. Some have even expressed concerns regarding the clinical implications of the attack; if their access to computers is blocked, then so is their access to outstanding test results and laboratory data, which are crucial to patient care (Financial Times). Some appointments have been cancelled; others remain in limbo while the HSE attempts to resolve the situation (Reuters).

Ransomware attacks involve hackers circulating seemingly harmless links or pop-ups which contain malicious software aimed at blocking access to computer systems. In exchange for restoring access to the systems, hackers often demand a ransom payment.

What It Means For Businesses and Law Firms

Ransomware attacks are on the rise (National Cyber Security Centre). The ongoing pandemic has contributed to this state of affairs, “due to a combination of weaker controls on home IT and a higher likelihood of users clicking on Covid-19 themed ransomware” (KPMG). In 2020, ransomware attacks involved demands worth $200,000 on average (LexisNexis), with some demands reaching “up to tens of millions of dollars” (CNN Business).

Earlier in May 2021, Colonial Pipeline, one of the largest fuel pipelines in the US, was forced to shut down its operations due to a ransomware attack (CNN). To resume its operations, the company paid $5 million to the hackers. Shortly after, Toshiba announced that its European business had been victim to a similar attack (CNBC). Aside from interrupting the ordinary course of business, ransomware attacks prompt significant financial losses, may result in reputational damage, and raise concerns relating to data protection. The IT systems of healthcare organisations have been viewed as particularly valuable targets amidst the pandemic (Financial Times).

Law firms with particular expertise in cyber security might be called upon to assist clients with navigating or pre-empting ransomware attacks. Equally, law firms might be victims of ransomware attacks themselves - by virtue of the sensitive information that they hold on behalf of clients (Forbes). In 2017, DLA Piper was the first prominent law firm to fall prey to such an attack; since then, multiple law firms have shared its fate, particularly in the US (Forbes). Failure to protect client information might tarnish law firms’ reputations, or attract litigation. To prevent ransomware attacks, law firms might consider conducting periodic audits of their IT security systems, and obtaining cybersecurity insurance (LexisNexis).