What happened
On 16 March 2021 an employee of Ireland's Health Service Executive received a phishing email with a Microsoft Excel file attached. The independent review by PwC calls the file malicious. On 18 March the employee opened it, and their workstation was infected. The review names that computer the Patient Zero Workstation.
The attackers then had eight weeks. They gained a foothold on 23 March. On 7 May they reached the HSE's own servers. Between 8 and 12 May they reached six voluntary hospitals and one statutory hospital. At 01:00 on 14 May 2021 they ran Conti ransomware. HSE management reported that about 80% of its IT environment was encrypted. The HSE shut down all of its IT and disconnected the National Healthcare Network.
The email
The public record says little about the message itself. PwC describes a phishing email carrying a malicious Excel attachment, sent to one user. Neither the review nor the auditor's report gives the sender, the subject or the pretext. What is documented is what followed the click.
Why it worked
One opened attachment was enough to start. Everything after that came from gaps the review lists in detail. On 31 March the antivirus software detected Cobalt Strike and Mimikatz, two common attack tools, but it was running in monitor mode and blocked nothing. The antivirus signatures on the first infected workstation had not been updated for over a year. On 10 May one hospital saw malicious activity. On 12 May another alerted the HSE. On 13 May the antivirus provider emailed the security operations team about unhandled threat events. None of these warnings led to action in time.
PwC assessed the HSE against 28 capabilities that matter in a ransomware attack. It rated the HSE high or very high risk on 25 of them. The organisation ran over 70,000 IT devices across about 4,000 locations.
What it cost
The attackers demanded a ransom of almost $20 million. The HSE did not pay. On 20 May the High Court granted an injunction, and the attackers posted a decryption key, which was validated the next day. By 21 September all servers and 1,075 of 1,087 applications were back.
Ireland's Comptroller and Auditor General counted €37 million in revenue spending and €14 million in capital spending in 2021, for the HSE alone. About €4.4 million more followed in 2022, plus €2.6 million in legal costs. The government added €43 million a year in ICT funding from 2022. Carrying out PwC's recommendations was estimated at almost €657 million over seven years. The auditor noted that the full cost had not been quantified. Behind those numbers were weeks of disrupted appointments and care across the country.
What would have helped
The review's own findings point to the fixes: security tools set to block, not only watch; current antivirus signatures; a team that acts on alerts within hours; and an organisation-wide plan for ransomware. The email was the first step. The eight weeks after it were where most of the damage could have been stopped.
Sources
- Conti cyber attack on the HSE: Independent Post Incident Review, PwC for the HSE Board, December 2021.
- Report on the Accounts of the Public Services 2021, chapter 12: Financial impact of cyber security attack, Office of the Comptroller and Auditor General, Ireland, 2022.
- Opening of email attachment led to HSE cyber attack, report finds, Colm Keena, The Irish Times, 10 December 2021.
- The Register's report on the PwC review, Gareth Corfield, The Register, 10 December 2021.