Cork expert warns recovery will be slow as HSE boss says process for unlocking network ‘fraught with risk’
A decryption key given to Government by the group responsible for the attack is being tested this weekend.
The process for unlocking the HSE network following the cyber attack remains “fraught with risk”, chief executive Paul Reid has said.
The fallout from the ransomware attack by an organised criminal gang will continue for some weeks to come, he warned.
A decryption key given to Government by the group responsible for the attack is being tested this weekend.
Mr Reid welcomed the news, but said it would not by a silver bullet for the crisis facing the health service.
On Saturday, he tweeted: “Access to the unlocking codes to our network is welcome.
We’ll continue to rebuild services & systems safely whilst evaluating the impact of these codes. The impact remains for the coming weeks for now.”
On Friday, Taoiseach Micheal Martin said the Government did not pay a ransom or use diplomatic channels to obtain the decryption key.
The key was made available on Thursday evening almost a week after the IT system was attacked.
It was given to the Government by the organised crime group behind the cyber attack, believed to be a gang calling itself Wizard Spider, but their reasons for doing so remain unclear.
Taoiseach Micheál Martin said: “No payment was made in relation to it at all. The security personnel don’t know the exact reason why the key was offered back.
“In terms of the operation of getting our services back and getting data systems back, it can help. But in itself, the process will still be slow.
“Certainly the decryption key, getting that is good, but in itself it doesn’t really take away from the enormous work that still lies ahead in terms of rebuilding the systems overall.”
He indicated the rebuilding process will be weeks rather than months.
Thousands of hospital appointments have been cancelled nationwide due to the attack, while there are concerns that sensitive patient data could be dumped and sold online.
Dr Sean McSweeney, the head of department in computer science at Munster Technological University, said it wasn’t “exceptionally unusual” that the hackers had provided the key.
Speaking to Newstalk Breakfast on Saturday, he said: “Typically with the threat actor, in this case it’s Wizard Spider as probably everyone is aware of at this point in time, it’s not unprecedented for the threat actor to hand over decryption software.
“My understanding is the tool was verified yesterday to be genuine, however, there are concerns within the National Cyber Security Centre and their contractors that there are back doors to this tool.
“Additionally, they have been offered a piece of software by a company known as Emsisoft that will extract the decryption key from the tool that Wizard Spider have offered them, and this is a much safer, more efficient approach to decrypting these scrambled files.”
He shared the concerns of the Taoiseach and Mr Reid that the process for getting systems up and running again will be painstakingly slow.
The ransomware attack resulted in the HSE having to close down all its IT services, causing widespread delays and the cancellation of appointments at hospitals across the country.
The number of appointments in some areas of the system has dropped by 80% as health workers grapple with paper records while work continues to recover IT systems.
The NCSC and the Garda National Cyber Crime Bureau are carrying out an international investigation into the attack.
App?
