A huge cyber attack leveraging hacking tools widely believed to have been developed by the US National Security Agency brought disruption to Britain’s health system on Friday and infected dozens of other countries around the world, security researchers said.
Hospitals and doctors’ surgeries in parts of England were forced to turn away patients and cancel appointments after they were infected with the “ransomware”, which scrambled data on computers and demanded payments of $300 to $600 to restore access. People in affected areas were being advised to seek medical care only in emergencies.
“We are experiencing a major IT disruption and there are delays at all of our hospitals,” said the Barts Health group, which manages major London hospitals. Routine appointments had been cancelled and ambulances were being diverted to neighbouring hospitals.
Telecommunications giant Telefonica was among many targets in Spain, though it said the attack was limited to some computers on an internal network and had not affected clients or services.
Ransomware is malicious software that infects machines, locks them by encrypting data and then extorts money to let users back in. A Telefonica spokesman said a window appeared on screens of infected computers that demanded payment with the digital currency bitcoin in order to regain access to files.
Rich Barger, director of threat research at U.S.-based security research company Splunk, said: “This is one of the largest global ransomware attacks the cyber community has ever seen.”
The ransomware attack has affected people and businesses across the world CREDIT: MALWARE TEC
Officials and experts identified the type of malware as ‘Wanna Cry’, also known as ‘Wanna Decryptor’. It exploits a vulnerability in Microsoft’s Windows operating system that allows it to automatically spread across networks, which gives it the ability to quickly infect large numbers of machines at the same organization.
It is the first piece of self-spreading ransomware, said Adam Meyers, a research with cyber security firm CrowdStrike. “Once it gets in and starts moving across the infrastructure, there is no way to stop it.”
The Wanna Cry malware exploits a vulnerability widely believed by security researchers to have been developed by the National Security Agency that was released on the Internet last month by a group known as the Shadow Brokers.
Andrea Zapparoli Manzoni, a senior manager in the Information Risk Management division of Kpmg Advisory in Italy, said: “The ransomware attack is happening in a haphazard fashion and is hitting every country in the world, including Italy.
“This particular ransomware contains a vulnerabilty, called Eternal Blue, which was developed in U.S. intelligence circles and was then stolen. That gives you an idea about why the level is risk is particularly high. The aim isn’t to hit any specific country but to strike as widely as possible to make money.”
Hospitals were a prime target, Manzoni said, because “they are very vulnerable to cyber attacks and ready to pay because they cannot afford any shutdowns.” Source: NHS ransomware cyber attack spreads worldwide