Closing summary
We’re wrapping up our live coverage of the ransomware cyber-attack and leave you with a summary of today’s main developments:
- Amber Rudd, the UK home secretary, said after chairing a meeting of the government’s emergency Cobra committee that 48 of the 248 NHS trusts in England were affected by Friday’s cyber-attack, with all but six now back to normal.
- Companies and organisations in almost 100 countries, including Nissan’s plant in Sunderland and Renault factories, were affected by the cyber-attack.
- Theresa May said there was “no evidence” that NHS patient records had been compromised in what Europol has described as an “unprecedented” attack.
- Labour has accused Jeremy Hunt, the health secretary, of ignoring “extensive warning signs” that could have prevented the attack on the NHS.
- The UK-based cybersecurity researcher who halted the global spread of the ransomware attack by registering a garbled domain name hidden in the malware has warned the attack could be rebooted.
- The criminals behind the cyber assault appear to have raised just $20,000 (£15,500) from their demands for bitcoin in return for decrypting files, experts told the Guardian.
- You can read our latest report here: Cyber-attack that hit NHS sparks bitter political battle over health spending.
Updated
The British Medical Association says the cyber attack has forced some doctors to “resort to pen and paper” rather than update patient records digitally.
Dr Mark Porter, BMA council chairman, said the incident was extremely worrying for patients and the doctors treating them.
“There have been reports of hospital doctors and GPs unable to access patients’ medical records, appointment booking systems and in some cases having to resort to pen and paper. NHS staff are working extremely hard to provide the best possible patient care and we hope NHS Digital are able to resolve these problems as soon as possible,” he said.
“We need to quickly establish what went wrong to prevent this happening again and questions must also asked about whether inadequate investment in NHS information systems has left it vulnerable to such an attack.”
The Scottish government says 13 NHS boards in Scotland were affected by Friday’s cyber attack.
NHS Digital says disruption to last for days
The aftermath of the cyber attack that affected 48 NHS bodies is likely to last for several days, with six still suffering disruption on Saturday.
NHS Digital said engineers are working “around the clock” to fix the problem. “We are aware some bodies, which range from practices to trusts, may have suspended selected systems purely as a precautionary measure,” a spokesman said.
“We are aware of widespread speculation about the use of Microsoft Windows XP by NHS organisations, who commission IT systems locally depending on population need. While the vast majority are running contemporary systems, we can confirm that the number of devices within the NHS that reportedly use XP has fallen to 4.7%, with this figure continuing to decrease.
“This may be because some expensive hardware (such as MRI scanners) cannot be updated immediately, and in such instances organisations will take steps to mitigate any risk, such as by isolating the device from the main network.”
More from Amber Rudd. Amid suggestions outdated software left some NHS systems vulnerable, the home secretary said it is important to remember that it was not the health service alone that has been affected.
“If you look at who’s been impacted by this virus, it’s a huge variety across different industries and across international governments. This is a virus that attacked Windows platforms. The fact is the NHS has fallen victim to this,” Rudd said.
“I don’t think it’s to do with that preparedness. There’s always more we can all do to make sure we’re secure against viruses, but I think there have already been good preparations in place by the NHS to make sure they were ready for this sort of attack.”
Updated
Amber Rudd admitted “there’s always more” that could be done to protect against viruses.
A fifth of trusts were hit by the ransomware on Friday afternoon, forcing hospitals to cancel and delay treatment.
Rudd said: “Of the 48 that have been impacted, most of them are back to normal course of business, so only six of them have some limits on their business.”
Updated
Amber Rudd has been speaking to Sky News political correspondent Beth Rigby:
I did ask the Home Sec when No 10 was going to take the Health Sec out of the cupboard (she said something about a cross-govt approach) #NHS
— Beth Rigby (@BethRigby) May 13, 2017
Updated
48 NHS trusts hit
Home Secretary Amber Rudd says Friday’s cyber attack affected 48 of the 248 NHS trusts in England, with all but six now back to normal.
All A&E departments are operating as normal, she said after chairing a meeting of Cobra, the government’s emergency response committee, on Saturday afternoon.
Updated
The Liberal Democrats have called for an inquiry into why the Conservatives cut cyber-security support for the NHS by ending a deal with Microsoft.
The party’s shadow home secretary, Brian Paddick, said: “We need to get to the bottom of why the government thought cyber-attacks were not a risk, when a combination of warnings and plain common sense should have told ministers that there is a growing and dangerous threat to our cyber-security.
“It is worrying that in Amber Rudd we have a home secretary in the digital age more suited to the era of analogue. This is not the first time she has looked lost in cyber-space. The government likes to look tough but this is an example of where it has left Britain defenceless. We demand to be told why.”
The “accidental hero” who halted the global spread of an unprecedented ransomware attack by registering a garbled domain name hidden in the malware has warned the attack could be rebooted.
The ransomware used in Friday’s attack wreaked havoc on organisations including FedEx and Telefonica, as well as the UK’s National Health Service(NHS), where operations were cancelled, X-rays, test results and patient records became unavailable and phones did not work.
But the spread of the attack was brought to a sudden halt when one UK cybersecurity researcher tweeting as @malwaretechblog, with the help of Darien Huss from security firm Proofpoint, found and inadvertently activated a “kill switch” in the malicious software.
The researcher, who identified himself only as MalwareTech, is a 22-year old from south-west England who lives with his parents and works for Kryptos logic, an LA-based threat intelligence company.
Sky News political correspondent Beth Rigby tweets that the Cobra meeting, scheduled to start at 230pm, has now concluded.
#COBR #NHSattack meeting over. Attendees included Hunt, Rudd, Treasury minister David Gauke, cab minister Ben Gummer & Lynne Owens of NCA
— Beth Rigby (@BethRigby) May 13, 2017
Many have been asking where health secretary Jeremy Hunt has been amid the computer chaos in the NHS.
He has finally emerged and was spotted earlier this afternoon arriving for the Cobra meeting in Whitehall, as Jon Vale of Press Association tweets.
Jeremy Hunt arrives at Whitehall for today's COBRA meeting after y'day's cyber attacks against the NHS pic.twitter.com/Mze3aviZZS
— Jon Vale (@JonValePA) May 13, 2017
Technology commentator Charles Arthur says the Tories are responsible for the sorry state of IT in the NHS:
Public services aren’t disproportionately targeted by hackers; if anything, they tend to offer less interesting pickings to profit-seeking hackers than smaller commercial outfits. But they constitute low-hanging fruit for ransomware in particular.
Amber Rudd can burble as much as she wants, but the £1bn put into the National Cyber Security Centre is a fraction of the amount needed to upgrade the NHS’s IT systems. The next government should acknowledge that fact.”
A Welsh government spokesperson said there had been no incidents in NHS Wales like those affecting NHS systems in England and Scotland.
“We have recently invested in upgrading IT to protect potentially vulnerable frontline NHS Wales systems. We have also introduced a national standard for IT security for all GP surgeries in Wales. We continue to monitor the situation closely,” the spokesperson said.
The global ransomware cyber-attack that targeted tens of thousands of computers in 100 countries and crippled NHS systems appears to have raised just $20,000 (£15,500) for the criminals behind it, experts working with investigators have told the Guardian.
Tom Robinson, co-founder of Elliptic, a company that identifies illicit activity involving bitcoin and provides services to most major law enforcement agencies in the US and UK, said that at least three bitcoin addresses have been identified as being associated with the malware used in Friday’s worldwide attack.
Read more here:
Updated
Rudd responds to Labour accusations
Labour wrote to the health secretary, Jeremy Hunt, earlier today to demand answers on the impact of the ransomware attack on the NHS. Home secretary Amber Rudd - not Hunt - has now replied to that letter.
“The malicious actions of the cyber criminals behind this attack have caused considerable distress for those patients who have been affected,” she wrote. “There is no evidence that any patient data has been compromised and the NHS has done brilliantly to manage the disruption.”
“But we must be careful not to characterise this as an attack on our NHS, and it is vital we do not jump to the wrong conclusions. As Europol have said, the scale of this attack is unprecedented and it is affecting a wide range of organisations in almost 100 countries around the globe.
“Today we have learned that Nissan’s plant in Sunderland has been affected, while according to reports others affected around the world include major telecoms firms, utility providers, railways, universities and local authorities.”
Responding to a suggestion by shadow health secretary Jonathan Ashworth that the government had failed to invest in NHS digital services, Rudd added: “We have doubled investment in cyber security to £1.9 billion and established the National Cyber Security Centre as part of GCHQ to act as a single point of contact for major incidents like this.
“The NCSC provides guidance to organisations on how to protect themselves from ransomware, and CareCERT was established in 2015 to provide national cyber support services for the health and care system. It is delivered by NHS Digital, working with the NCSC, and since 2015 more than £50 million have been made available to support CareCERT services.”
And in a final swipe against Labour, she said: “Should you have any concerns about the security of the Labour Party’s own systems, GCHQ stand ready to provide a briefing on how best to minimise the risk of a successful attack.”
May says 'no evidence' patient records compromised
Theresa May said there is “no evidence that patient records have been compromised” and thanked NHS staff for working overnight.
“This cyber attack that has taken place has affected organisations here in the UK but in many countries around the world as well. Europol has said that it is unprecedented in terms of the scale of the cyber attack that has taken place. The National Cyber Security Centre is working with all organisations here in the UK that have been affected and that’s very important,” the prime minister said.
“I’d like to thank particularly the NHS staff who have been working through the night to ensure that, as we know, there has been no compromise of patient records.”
May also said it was “entirely right” for Amber Rudd to chair a Cobra meeting this afternoon.
“The home secretary has responsibility for these issues but the government is ensuring through our National Cyber Security Centre that we are giving this our full attention and working with all the organisations concerned to resolve it.”
Updated
More from Germany, where the main victim of the cyber-attacks appears to be Deutsche Bahn, the national rail network, whose surveillance technology has been seriously affected.
Germany’s federal crime police office the BKA has taken over the criminal investigation to find the culprits, according to interior minister Thomas de Maiziere. He said the attack has caused a “very serious threat” that authorities had repeatedly warned was likely.
According to a DB spokesman, the attack led to the partial shutting down of digital display boards across the country, as well as the failure of ticket machines at railway stations. Video surveillance technology across the country was also affected, a spokesman for the interior ministry said.
According to the interior ministry spokesman, government computer networks remained unaffected by the attack. DB appears to be the only organisation that has been attacked in Germany, but whether it has also been affected by the “WannaCry” trojans is unclear.
Across the country, travellers reported that digital arrival and departure information display boards had been disrupted. Instead of the normal information, the empty display boards flashed messages informing passengers: “please refer to timetables”.
The bahn.de website and smartphone app appeared to have been unaffected, a spokesman for DB said. Ticket offices remained opened and rail traffic was apparently unaffected by the attack.
Updated
The UK-based cybersecurity researcher credited with helping to stop the spread of the ransomware attack has written an article - How to Accidentally Stop a Global Cyber Attack - explaining what happened on his MalwareTech blog.
My blog post is done! Now you can read the full story of yesterday's events here:https://t.co/BLFORfM2ud
— MalwareTech (@MalwareTechBlog) May 13, 2017
You might need a computer science degree to understand some of it though.
The digitalhealth.net site reports that some of the disruption to NHS services has been caused by trusts turning computer systems off as a precautionary measure, rather than them being infected by the ransomware.
One leading NHS IT director told Digital Health News: “All of the reports on the BBC [about disruption] are directly related to people having shut down networks, nothing to do with the ransomware itself.
“I know people have been hit, but I fail to see how disconnecting clinical systems from networks helps anyone. If your clinical system can be attacked by ransomware, there is something seriously wrong with its deployment.”
Updated
Mikko Hypponen, chief research officer at Helsinki-based cyber security company F-Secure, says the attack is “the biggest ransomware outbreak in history”, affecting 130,000 systems in more than 100 countries.
He says that Russia and India were hit particularly hard, partly because the older Windows XP operating system is still widely used in the countries.
German rail operator Deutsche Bahn said its systems were infected as part of the global cyber attack that has wreaked havoc in almost 100 countries.
Although train services were not disrupted, some arrivals and departures boards at stations had been affected.
Pictures posted online by travellers showed red windows appearing on announcement boards with a message demanding payment to restore access. Deutsche Bahn said it was working to rectify the problem.
German interior minister Thomas de Maiziere said government computer systems were not affected.
Labour leader Jeremy Corbyn has also responded to the attack:
What we’ve now got is a bunch of 21st Century highway robbers that have hacked into our NHS and are basically offering protection money to get the information back in order to treat cancer patients or anybody else. It’s unbelievably disgusting and I’ve got nothing but contempt for those people that have done it, and I’m sure all of you would share that.
But I’m also very angry that in 2014, there was a one-year renewal of the protection system on the NHS systems which was not renewed after that and not renewed the year after that and so are systems are now not upgraded and not protected. As a result, we’ve got this dreadful situation that NHS workers are facing today.
And so we obviously support our NHS workers but I tell you this, a Labour government would not leave our NHS’s very vital information systems unprotected. We would protect them.”
Labour said there have been repeated warnings about the vulnerability of the outdated NHS systems, including from the National Cyber Security Centre and the National Crime Agency.
Many had been left “extremely vulnerable” to an attack since 2015, when they continued to use an outdated version of Windows after a security package had been stopped, Jon Ashworth said.
“NHS Trusts have been running thousands of outdated and unsupported Windows XP machines despite the Government ending its annual £5.5m deal with Microsoft, which provided ongoing security support for Windows XP, in May 2015,” the shadow health secretary wrote in his letter to Jeremy Hunt.
“It effectively means that unless individual trusts were willing to pay Microsoft for an extended support deal, since May 2015 their operating systems have been extremely vulnerable to being hacked.”
A freedom of information request in February found that 79 English NHS trusts had suffered ransomware attacks since June 2015, Ashworth said.
Labour accuses Hunt over NHS attack
Labour has accused Jeremy Hunt of ignoring “extensive warning signs” before the unprecedented cyber attack that has plunged the NHS into chaos.
Shadow health secretary Jonathan Ashworth said concerns were repeatedly flagged about the NHS’s outdated computer systems, which left it vulnerable to the virus.
In a letter to Hunt on Saturday he wrote: “As Secretary of State, I urge you to publically outline the immediate steps you’ll be taking to significantly improve cyber security in our NHS. The public has a right to know exactly what the Government will do to ensure that such an attack is never repeated again.”
Nissan's Sunderland plant affected
The huge Sunderland car factory owned by Nissan has been struck by the cyber attack, halting production at 5pm on Friday.
A Nissan spokesman told Newcastle’s ChronicleLive: “Like many organisations, our UK plant was subject to a ransomware attack affecting some of our systems on Friday evening. Our teams are working to resolve the issue.”
Updated
It’s worth remembering that back in February 2016 a Californian hospital paid $17,000 in bitcoin after hackers installed a virus on its computer systems that encrypted their computer files.
Hollywood Presbyterian Medical Center lost access to its computer systems on 5 February. Almost two weeks later the hospital said it had paid up to regain access to its data.
The move was one of the most high-profile examples of a hacking victim paying the fee for so-called ransomware.
BBC technology correspondent Rory Cellan-Jones tweets:
Love the fact that the hero who stopped the ransomware spreading regards it as almost accidental! https://t.co/fqlnhBXYTq
— Rory Cellan-Jones (@ruskin147) May 13, 2017
I will confess that I was unaware registering the domain would stop the malware until after i registered it, so initially it was accidental.
— MalwareTech (@MalwareTechBlog) May 13, 2017
Updated
French carmaker Renault is the first French firm to be hit by the global cyberattack, management said on Saturday.
“Work is going on since last night. We are doing what is needed to counter this attack,” a spokesperson said.
“The problems were mainly related to France, where some of Renault’s factories also faced a malfunctioning of certain parts of its information system,” she added.
The attack has also halted production at Renault’s Revoz subsidiary in Slovenia after computer systems were hit.
Updated
The Guardian’s Samuel Gibbs reported in May 2015 that the Government Digital Service had decided not to continue its £5.5m deal with Microsoft to extend support for Windows XP. That decision left government computers still running on the obsolete operating system at risk from hackers and may be one reason why some NHS trusts fell victim to the attack on Friday.
The service said ending the support meant “weaknesses that are found in unsupported products will remain unpatched and will be exploitable by relatively low-skilled attackers”.
Microsoft withdrew its extended support programme for Windows XP, its 14-year-old operating system, in April 2014. Given the number of Windows XP PCs still being used in government and businesses at the time, Microsoft provided paid-for extended support on a one-off basis.
Updated
The threat posed by the cyber-attack has receded for the time being, partly because a UK-based cyber security researcher registered a domain that he noticed the malware was trying to connect to, limiting its spread.
“We are on a downward slope, the infections are extremely few, because the malware is not able to connect to the registered domain,” said Vikram Thakur, principal research manager at Symantec. “The numbers are extremely low and coming down fast.”
But the attackers could yet tweak the code and start the new cycle. The British-based researcher, whose Twitter handle is @MalwareTechBlog, said he had not seen any such tweaks yet, “but they will”.
Updated
Russia’s central bank says it had detected “massive” cyber-attacks on domestic banks, which successfully defended them, the RIA news agency reports.
Russian media said that state-owned Russian Railways also successfully defended itself from a cyber-attack.
Updated
Cobra meeting called
The home secretary, Amber Rudd, will chair a Cobra meeting in Whitehall at 2.30pm.
Updated
The cyber-attack has affected some hospitals, schools and universities in Asia, but the extent of any damage remains unclear.
China’s official news agency, Xinhua, said secondary schools and universities were hit but did not say how many. Sun Yat-sen university said it received a large number of virus complaints on Friday, financial magazine Caixin reported.
William Saito, cyber security adviser to the Japanese cabinet government, said some institutions were affected but did not elaborate.
South Korea’s Yonhap news agency said a university hospital in Seoul had been hit as well. Two hospitals in Jakarta were hit, according to an Indonesian official.
Updated
Amber Rudd admits there is chance not all NHS files are backed up
Amber Rudd told BBC Breakfast she could not confirm that all NHS files are backed up. She said:
I hope the answer is yes, that is the instructions that everybody has received in the past. That is good cyber-defence, but I expect, and we will find out over the next few days if there are any holes in that.
There may be lessons to learn from this but the most important thing now is to disrupt the attack, let’s come back to afterwards whether there are lessons to be learned.
Rudd later told Sky News: “It is disappointing that they [the NHS] have been running Windows XP - I know that the secretary of state for health has instructed them not to and most have moved off it.”
She added: “Where the patient data has been properly backed up, which has been in most cases, work can continue as normal because the patient data can be downloaded and people can continue with their work.”
Now, if only someone could find that extra £350 million a week they promised for the NHS...
— Graham Cluley (@gcluley) May 13, 2017
Updated
G7 finance ministers turned their focus today to combating cybercrime in what Italy’s Pier Carlo Padoan described as an “unfortunately very timely” discussion, AFP reports.
The ministers from the group of seven wealthy democracies will say that cyber incidents represent a growing threat to their economies and that tackling them should be a priority, Italian officials said.
The talks, scheduled before Friday’s events, focused particularly on the potential threat to the global financial system in the event of hackers being able to infiltrate the computer systems that run the global banking system, capital and equity markets.
The ministers, who also discussed inequality, and transnational tax evasion during their two-day review of the world economy, were due to wrap up their talks at lunchtime.
“We are agreed on many things ... including on the fight against cybercrime which is unfortunately very timely,” Padoan said on his arrival for Sunday’s closing session.
Updated
The UK National Cyber Security Centre is sharing advice on how to prevent a ransomware hack and what to do if you’ve been targeted.
How to prevent a ransomware incident and what to do if your organisation is infected https://t.co/YSmFYATtAK pic.twitter.com/NhdC5fIWWG
— NCSC UK (@ncsc) May 13, 2017
The Scottish government has said it is working closely with health officials following the hack of 11 of Scotland’s 14 NHS health boards.
The Scottish health secretary, Shona Robison, who chaired a Scottish government resilience meeting earlier this morning, said work to fix the systems had entered a “recovery phase”. She told the BBC’s Good Morning Scotland programme:
People are working very, very hard and have worked through the night. The update I’ve got this morning is that we’re very much into recovery phase now, with a lot of work going on to get systems back up running.
The GP systems, which of course were the main problem across our health boards - work is going on, and there is a level of confidence that many will be back up and running before GP surgeries open on Monday morning.
Robison added that there has been no detection of breach to patient confidentiality “so patients should be reassured by that”.
Updated
NHS trusts unaffected by the hack are taking precautionary measures.
We have not been affected by the #nhscyberattack but have switched off inbound external emails for precaution and will review on Monday.
— Leics Part NHS (@LPTnhs) May 13, 2017
Here’s some more from the home secretary’s media round this morning, in which she’s giving very few details about the investigation into the attack.
Rudd said the attack “feels random in terms of where it’s gone to and where it’s been opened”, but said the authorities did not yet know where it had originated.
She added: “Windows XP is not a good platform for keeping your data as secure as the modern ones, because you can’t download the effective patches and anti-virus software for defending against viruses.
“CQC (Care Quality Commission) does do cyber-checks on the NHS trusts, on hospitals when they do their visits, and they will be advising NHS trusts to move to modernise their platforms and I think that after this experience, I would expect them all to move forward with modernising.”
Rudd said the UK was a world leader in cyber security, adding: “So far, all we have seen is patients inconvenienced, some hospitals, some doctors making changes to their daily life.
“But the fact is no data has yet been accessed and the NHS are brilliantly managing to weave through this disruption.”
Updated
NHS must upgrade software - Amber Rudd
Amber Rudd, the home secretary, has been responding to the attack on BBC Radio 4’s Today programme.
“We are not able to tell you who is behind that attack,” she said. “That work is still ongoing. We don’t know anymore about where it has come from at the moment. We know it has affected up to 100 countries and it wasn’t targeted at the NHS.
“We know from the information we have on the type of virus that it feels random about where it has gone to and where it was opened. It is the type of virus that works particularly effectively between systems that are connected to each other so it is more likely to impact larger organisations than individuals. No patient data has been accessed or transferred in any way, thats the information we’ve been given.”
She added that she expected to see the NHS update its computer systems in the wake of the attack, following reports that the organisation may have been made vulnerable by running outdated Microsoft software.
“I expect NHS trusts to learn from this and make sure they do upgrade,” Rudd said.
Microsoft said its decision to make the software patch available to all was “made based on an assessment of this situation, with the principle of protecting our customer ecosystem overall, firmly in mind”.
It warned that some of the attacks relied on common phishing tactics and urged customers to be vigilant when opening documents from untrusted or unknown sources.
Microsoft has released a solution for all Windows users, regardless of whether they are supported or not. The corporation said it was “painful” to see how businesses and individuals had been affected by the attack.
Microsoft releases #WannaCrypt protection for out-of-support products Windows XP, Windows 8, & Windows Server 2003: https://t.co/ZgINDXAdCj
— Microsoft (@Microsoft) May 13, 2017
Updated
Summary
If you’re just joining us, here’s what we know so far about Friday’s cyber-attack that has affected countries and organisations across the globe:
- A global ransomware attack has hit the UK’s National Health Service hardest, forcing hospitals to cancel operations and divert ambulances and rendering documents such as patient records and x-rays unavailable. The National Cyber Security Centre says teams are “working round the clock” to bring systems back online. NHS Digital and prime minister Theresa May say there is no evidence patient data has been accessed.
- Thousands of patients across England and Scotland are stuck in limbo, with parents of newborns unable to take them home. The service will doubtless face a weekend of delays and non-emergency patients have been urged to use health facilities frugally.
- A security expert has been hailed an “accidental hero” for his role in halting the spread of the WanaCrypt0r 2.0 bug. The man behind the @MalwareTechBlog Twitter account is reported to have simply paid a few dollars to register a domain name that, once active, performs the role of a “kill switch” that deactivates the malware in its current form.
- Tens of thousands of attacks were registered in 99 countries. Russia, Ukraine, India and Taiwan initially appeared to be most hard hit, though details are yet to emerge. Russia said 1,000 computers at its interior ministry were affected.
- The malicious software asks for a $300 (£233) ransom per machine to be paid in cryptocurrency Bitcoin to unlock computers. Some payments are reported to have been made.
- The bug appears to originate from a malware dump made by a group called Shadow Brokers, which claim to have stolen a cache of “cyber weapons” from the National Security Agency (NSA).
- In Spain, megaphone announcements told employees at telecom giant Telefónica to close their workstations immediately while the attack spread.
- Scotland reported that 11 health boards and its ambulance service attacked.
- Whistleblower Edward Snowden blamed the NSA, saying: “If @NSAGov had privately disclosed the flaw used to attack hospitals when they *found* it, not when they lost it, this may not have happened.”
- FedEx also announced it was affected and said it was “implementing remediation steps as quickly as possible”.
Read the Guardian’s full report on the attack here:
Updated
The security expert credited with halting the spread of the bug – at least in its current iteration – might have quite a busy weekend by the looks of it.
*finishes reading notifications*
— MalwareTech (@MalwareTechBlog) May 13, 2017
*refreshes page* pic.twitter.com/EHjMpMOU0e
Updated
Here is a fuller read on the plight of the NHS as we enter day two of the crisis for the organisation, which appears by far the biggest victim of the cyber-attack.
Patients at hospitals and GP surgeries in England and Scotland will face a weekend of disruption, as delays that began on Friday spill over into the weekend.
The shadow health secretary Jonathan Ashworth urged the government to be “clear about what’s happened”, describing the attack as “terrible news and a real worry for patients”.
The notoriously difficult process of tracking down the source of the attack begins.
Ciaran Martin, the head of the UK’s cyber security agency, told the BBC on Friday night: “It’s important to understand that cyber attacks can be different from other forms of crime in that their sometimes highly technical and anonymous nature means it can take some time to understand how it worked, who was behind it and what the impact is.”
IP addresses from our sinkhole have been sent to FBI and ShadowServer so affected organisations should get a notification soon. patch ASAP.
— MalwareTech (@MalwareTechBlog) May 13, 2017
The malware researcher who helped curtail the spread of the attack has pointed out that escaping this attack does not necessarily safeguard against further, similar attacks.
So long as the domain isn't revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again.
— MalwareTech (@MalwareTechBlog) May 13, 2017
Taiwan’s department of cyber security has said the island’s government agencies and hospital systems appear to be so far unaffected by the attack. Taiwan was prominent on the list of places affected by the WanaCrypt0r 2.0 bug.
However, Howard Jyan, the director general of the government department said there had been no disruption and that Taiwan was ready for any future attacks, adding “We can control the situation.”
Meanwhile, Ross Feingold, a Taiwan-based political analyst who advises on Taiwan and Hong Kong political affairs, said: “As the attack commenced on Friday night Taiwan time, many organisations, whether government or private sector, will only know the true impact on Monday morning when personnel return to work, turn on their computers, and possibly click on malware and/or otherwise discover that the organisation is the victim of ransomware.”
“However, it once again demonstrates that Taiwan’s cyber security, as in other areas of its defences, requires ongoing investment in software, hardware, and personnel training so that they can identify suspicious emails in both Chinese and English.”
Updated
This malware tracker from MalwareTech gives a map view of where the ransomware struck across the globe. The timeline underneath shows just how quickly it spread, and the sharp dip coincides presumably with the moment the “accidental hero” registered the domain name that halted the attack for the most part.
The Register reports that payments appear to have been made to Bitcoin addresses given as part of the attack on the UK’s National Health Service. This attack asks for $300 in Bitcoin payments to release files encrypted on the infected device. Affected users face the prospect of paying up – with no guarantee a cyber-criminal will indeed unlock his files – or trying to resort to back-up files.
The blame game for what has been described by Rohyt Belani, the chief executive of email security company PhishMe, as the “atom bomb of ransomware”, has a long way to run.
The New York Times here considers whether it should be the hackers (who found and used the tool) the NSA (which appears to have had some role in exploiting a vulnerability it discovered) or the victims (organisations and people who, for a variety of reasons, did not keep their system sufficiently secure).
A handy guide here by Alex Hern and Samuel Gibbs on the tech aspect of this event. It gives an idea of how quickly this kind of attack can spread, and how vulnerable major institutions around the world can be if their security upgrades are outpaced by hackers.
The human cost of what is a random attack, spread via email, is still emerging. In the UK, thousands of patients faced disruption as x-rays, test results and patient records became unavailable and operations were cancelled.
Royal London hospital had to delay the release of newborns to go home, according to one father, whose child did not have any wrist tags. Warren Jones said: “It is normal to have two baby tags – we have got no tags. They can’t print them out, I’m guessing. It is a bit disappointing, really. I don’t know how easy it is but they have taken over a whole system and shut it down.”
Patient transfers were also hit. One woman said her daughter, who is in a wheelchair, could no longer be moved to another hospital. “I went to the nurses: ‘Oh, I need to know, is it tonight?’ and they went: ‘Did you not hear about the cyber-attack? Everything is on hold.’”
You can read more here:
NHS Digital, the information arm of the UK’s health service, has said “we do not have any evidence” that patient data has been accessed as a result of the attack. It has yet to address the issue of whether the organisation’s IT network had an outdated security set-up.
I will confess that I was unaware registering the domain would stop the malware until after i registered it, so initially it was accidental.
— MalwareTech (@MalwareTechBlog) May 13, 2017
Here is the full read on the cybersecurity researcher who appears to have played a huge role in tackling the spread of the malware, by taking control of the domain name to which the code is linked.
Officials in Australia are working to ascertain whether the attack has affected organisations there. The prime minister, Malcolm Turnbull, said via a spokesman: “We are continuing to monitor the situation closely and stand ready to deal with any cyber-security threat to Australia’s critical infrastructure.”
There are no confirmed reports Australian organisations have been hit.
Thank you, Sam. Friday’s ransomware attack has seen Taiwan become one of its main victims and we’re working to find out more details about how organisations there have been affected. The island is one of the most hacked places in the world, with its geopolitical situation. Dozens of its schools have been targeted with ransomware this year. Of course, this latest cyber-attack is more random in nature.
What we know so far
Here’s what we know so far about the massive ransomware cyber-attack that has affected countries across the globe:
- There have been reports of tens of thousands of attacks in 99 countries, including the UK, Russia, Ukraine, India, China, Italy and Egypt.
- The NHS was hit as part of the attack, and staff across at least 16 trusts in the UK were affected – locked out of computers and forced to divert emergency patients.
- Thousands of patients across England and Scotland were stuck in limbo, with many having operations cancelled at the last minute.
- By late Friday evening, the ransomware had spread to the United States and South America, though Europe and Russia were most hard hit.
- A group called Shadow Brokers made the malware dump available online earlier this month, claiming to have stolen a cache of “cyber weapons” from the National Security Agency (NSA).
- The malicious software is known as WanaCrypt0r 2.0 and was asking for a $300 (£233) ransom per machine to be paid in cryptocurrency Bitcoin to unlock computers.
- In Spain, megaphone announcements told employees at telecom giant Telefónica to shut down their workstations immediately while the attack spread.
- Scotland reported that 11 health boards and its ambulance service attacked.
- Whistleblower Edward Snowden blamed the NSA, saying: “If @NSAGov had privately disclosed the flaw used to attack hospitals when they *found* it, not when they lost it, this may not have happened.”
- FedEx also announced it was impacted and said it was “implementing remediation steps as quickly as possible”.
The Guardian’s Graham Russell will now be taking over the blog.
Guardian tech reporter Olivia Solon explains how a cybersecurity researcher was able to block the spread of the malware:
The global spread of the WannaCry ransomware has been stopped by a cybersecurity researcher tweeting as @malwaretechblog, with the help of a researcher at Proofpoint.
The malware contains a hardcoded “kill switch” that the creator could choose to implement if he or she wanted. This involved a very long nonsensical domain name that the malware makes a request to – just as if it was looking up any website – and if the request comes back and shows that the domain is live, the kill switch takes effect and the malware stops spreading. Of course, this relies on the creator of the malware registering the specific domain. In this case, the creator failed to do this. And @malwaretechblog did early this morning (Pacific Time), stopping the rapid proliferation of the ransomware.
“They get the accidental hero award of the day,” said Proofpoint’s Ryan Kalember. “They didn’t realize how much it probably slowed down the spread of this ransomware.”
The time that @malwaretechblog registered the domain was too late to help Europe and Asia, where many organizations were affected, but gave people in the US more time to develop immunity to the attack by patching their systems before they were infected, said Kalember.
It’s possible that there are other variances of the malware with different kill switches that have not yet been intercepted.
Patients left waiting for hours
There are thousands of patients across England and Scotland who have been left in limbo, many forced to cancel operations at the last minute, the Guardian’s Kevin Rawlinson reports:
Senior medics sought to reassure patients that they could be seen in the normal way in emergencies, but others were asked to stay away if possible.
According to one junior doctor who works in a London hospital, the attack left hospitals struggling to care for people. “However much they pretend patient safety is unaffected, it’s not true. At my hospital we are literally unable to do any x-rays, which are an essential component of emergency medicine,” the doctor told the Guardian.
Read more about the chaos in hospitals here:
The US Department of Homeland Security (DHS) has released a statement saying it is “aware of reports of ransomware known as WannaCry affecting multiple global entities”. DHS noted that Microsoft released a patch in March that addresses this vulnerability, adding:
Individual users are often the first line of defense against this and other threats, and we encourage all Americans to update your operating systems and implement vigorous cybersecurity practices at home, work, and school.
DHS said it is also “actively sharing information related to this event and stand ready to lend technical support and assistance as needed to our partners, both in the United States and internationally”. The agency further said it is working with chief information officers in other US federal departments to ensure “our own networks are protected against the threat”.
The rapid spread of the malware may have been stopped when a researcher who tweets at MalwareTech and works for security firm Kryptos Logic took control of key domain name, according to tech blog ArsTechnica.
God damn. Looks like @MalwareTechBlog stopped the spread of this global ransomware attack https://t.co/pgDiTS9oTR pic.twitter.com/YyFKt7cQwy
— Joseph Cox (@josephfcox) May 12, 2017
The site reports:
The address appeared to serve as a sort of kill switch the attackers could use to terminate the campaign. MalwareTech’s registration had the effect of ending the attacks that had started earlier Friday morning in other parts of the world. As a result, the number of infection detections plateaued dramatically in the hours following the registration.
This won’t, however, help companies that have already been infected.
Corporations in Spain regain control
The Cybersecurity National Institute in Spain is reporting that many of the country’s corporations targeted in the ransomware attack are regaining control over their systems and resuming operations, according to the AP.
A statement released by the institute did not identify affected companies, though Telefonica, Spain’s telecommunications corporation, acknowledged the attack earlier in the day.
The institute said that many Spanish corporations were alerted early enough that they were able to dodge the malware, the AP reported.
Telefonica said earlier that the attack was limited to its internal network computers and had not impacted services or clients.
US congressman Ted Lieu, a Democrat from California and one of the more technologically savvy lawmakers, criticized the NSA’s suspected role in the WannaCry malware on Twitter.
Best way to protect US & the world is for NSA/CIA to DISCLOSE zero-day vulnerabilities to software owner, NOT WRITE MALWARE. #ransomware https://t.co/dAsbDJywHt
— Ted Lieu (@tedlieu) May 12, 2017
If true, unacceptable NSA wrote malware & did not disclose vulnerability. I've been working on bill to address this very issue. #ransomware https://t.co/sujC648iZs
— Ted Lieu (@tedlieu) May 12, 2017
To be clear, the NSA is not necessarily suspected of writing the actual malware involved in this hack, but rather of knowing about and failing to disclose the flaw in Windows that the ransomware exploits.
Software companies offer bug bounties to hackers who inform them about such vulnerabilities, allowing them to issue security patches through software updates. But intelligence agencies stockpile their knowledge of such flaws in order to use them for intelligence gathering or cyber warfare.
Sam Levin in San Francisco will be taking over the blog for now.
Updated
The National Cyber Security Centre’s CEO Ciaran Martin has issued a new statement on the ransomware attack.
Martin said the NCSC is “working round the clock” with UK, international, and private sector partners to respond to the attack, and reiterated that there is no evidence that NHS patient data has been stolen.
“We are very aware that attacks on critical services such as the NHS have a massive impact on individuals and their families, and we are doing everything in our power to help them restore these vital services.”
The NCSC’s guidance for protecting yourself from ransomware can be found here.
The Russian interior ministry said earlier today that about 1,000 computers of its computers had been affected. The country’s largest bank, Sberbank, was also targeted, according to the Associated Press, but said that it had successfully repelled the attack.
Russia was hit early and hard by the attack, which could be a sign that the attacks originated in that country, according to Markus Jakobsson, chief scientist with security firm Agari.
Since the malware spreads by email, he told the Guardian, it’s possible that the criminals had access to a large database of Russian email addresses.
However, Jakobsson warned that the origin of the attack remains unconfirmed.
Scotland: 11 health boards and ambulance service attacked
Eleven of Scotland’s 14 geographical health boards and its ambulance service have been affected by the global cyberattack, according to the Press Association.
“I have convened a Scottish Government resilience meeting to ensure that we are closely monitoring the situation,” first minister Nicola Sturgeon said. “All necessary steps are being taken to ensure that the cause and nature of this attack is identified. There is no evidence that patient data has been compromised.”
The impacted health boards are NHS Borders, Dumfries and Galloway, Fife, Forth Valley, Lanarkshire, Greater Glasgow and Clyde, Tayside, Western Isles, Highlands, Grampian, Ayrshire and Arran, and the Scottish Ambulance Service.
Ransomware attacks have been on the rise around the globe, and hospitals are particularly vulnerable, thanks to outdated IT systems and increasing reliance on electronic health records.
The BBC reported in April that the NHS hospital trusts in England saw 55 cyber attacks in 2016.
Last year, a hospital in Los Angeles was infected with ransomware. Doctors and nurses resorted to using paper charts and fax machines for days before the hospital paid $17,000 in bitcoin to the ransomware hackers.
“The attack against the NHS demonstrates that cyber-attacks can quite literally have life and death consequences,” Mike Viscuso, chief techology officer of security firm Carbon Black, told the Guardian. “When patients’ lives are at stake, there is no time for finger pointing but this attack serves as an additional clarion call that healthcare organizations must make cybersecurity a priority, lest they encounter a scenario where lives are risked.”
Global courier company FedEx has been infected by the ransomware.
“Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware,” a spokesperson said in a statement. “We are implementing remediation steps as quickly as possible. We regret any inconvenience to our customers.”
The WannaCry ransomware has now spread to 99 countries, according to security firm Avast.
The suspected origin of the ransomware in a vulnerability known to the US’s National Security Agency is already leading to finger-pointing by some critics.
Experts believe that WannaCry works by taking advantage of a flaw in Windows that the NSA knew about but kept secret. Intelligence agencies keep a stockpile of such vulnerabilities and use them to carry out intelligence gathering or engage in cyberwarfare.
This particular vulnerability was publicly disclosed by a group calling itself Shadow Brokers, which claimed to have stolen it from the NSA. Once the flaw was public, Microsoft issued a fix, but many users and institutions are slow to install security updates.
Edward Snowden articulated the critique of the NSA’s role in the attack on Twitter.
If @NSAGov had privately disclosed the flaw used to attack hospitals when they *found* it, not when they lost it, this may not have happened https://t.co/lhApAqB5j3
— Edward Snowden (@Snowden) May 12, 2017
Kaspersky Lab, a cybersecurity company based in Moscow, has published a blogpost in which it estimates that 45,000 attacks have been carried out in 74 countries, mostly in Russia. It added that the totals could be “much, much higher”. You can read the full analysis here.
Julia Wong in San Francisco will now be taking over the liveblog.
Updated
NHS staff and patients have been getting in touch with us.
One NHS junior doctor at a London hospital, who wishes to remain anonymous, said they were unable to look after patients properly:
However much they pretend patient safety is unaffected - it’s not true. At my hospital we are literally unable to do any X-rays, which are an essential component of emergency medicine.
It’s a good hospital in many ways but the IT is appalling ... This is the 3rd or 4th time there has been major computer downtime since I started at my current hospital, 8 months ago. I know the staff will do their very best to keep looking after everyone, but there are no robust systems in place to deal with blackouts like this - information sharing is hard enough in a clinical environment when everything works.
Without the IT systems I suspect test results will be missed, and definitely delayed. Handovers are much more difficult. It will, absolutely certainly, impact patient safety negatively, even if that impact can’t be clearly measured.
Updated
Hacking tool was probably stolen from NSA, expert says
A little more detail on how the attack on may have come about: According to Prof Alan Woodward, a security expert at Surrey University, it resembles an exploit of “EternalBlue” - the name given to a weakness in Microsoft’s security that is thought to have been identified secretly by the US National Security Agency (NSA).
A hacking group calling itself Shadow Brokers claimed to have stolen information about the vulnerability from the NSA last year, as part of a cache of files. It tried to auction them off but, after no one made a satisfactory bid, reportedly dumped them online for free. Microsoft released a fix and some researchers have suggested that a failure to implement it may have exacerbated the problem. He told the Guardian:
From the analysis that has been done, it looks like it is the ‘EternalBlue’ weakness that has been exploited because it is using the same ports and protocols. We don’t know publicly if it is the NSA (that found the vulnerability) but it is widely assumed it is and that is what Shadow Brokers said.
Updated
More than half of Scotland’s health boards have been affected by the large-scale cyber-attack on NHS computer systems. GP surgeries and dental surgeries were among some of the locations hit by the ransomware attack on IT networks, the Press Association reports.
NHS Lanarkshire said only those patients requiring emergency treatment should attend hospital while they dealt with the issue on Friday.
Scotland’s biggest health board, NHS Greater Glasgow and Clyde, as well as NHS Tayside, NHS Dumfries and Galloway and NHS Forth Valley confirmed that some of their GP surgeries had been caught up in the incident.
NHS Western Isles, NHS Fife and NHS Borders said they have been affected to some extent. It means that at least eight of Scotland’s 14 health boards have reported some level of disruption as a result of the attack.
There is no evidence that patient data has been compromised.
Updated
The Agence France-Presse news agency reports that, in Spain, employees at the telecom giant Telefónica were told to shut down their workstations immediately through megaphone announcements as the attack spread.
Forcepoint Security Labs said that “a major malicious email campaign” consisting of nearly 5m emails per hour was spreading the ransomware.
The group said in a statement that the attack had “global scope”, affecting organisations in Australia, Belgium, France, Germany, Italy and Mexico.
Photograph: Juan Medina/Reuters
Updated
Some more quotes from the prime minister. She has told reporters:
I think what is important is that we have recognised that increasingly we need to be aware of the need to address cyber security issues, that’s why the National Cyber Security Centre has been set up. It is now able to work with the NHS to support the organisations concerned and to ensure that patient safety is protected.
After the prime minister said she was “not aware of any evidence that patient data has been compromised”, Ross Anderson, a professor of security engineering at Cambridge university, advises caution.
The NHS are saying that patient privacy hasn’t been compromised, but if significant numbers of hospitals have been negligently running unpatched computers for two months after the patch came out, how do they know?
Some more on that statement from the prime minister, Theresa May, who says:
We are aware that a number of NHS organisations have reported that they have suffered from a ransomware attack.
This is not targeted at the NHS, it’s an international attack and a number of countries and organisations have been affected.
The National Cyber Security Centre is working closely with NHS Digital to ensure that they support the organisations concerned and that they protect patient safety.
And we are not aware of any evidence that patient data has been compromised.
Of course, it is important that we have set up the National Cyber Security Centre and they are able to work with the NHS organisations concerned and to ensure that they are supported and patient safety is protected.
Updated
There are reports around that as many as 40 NHS organisations have been hit by the cyber-attack. NHS Digital says it is not going to confirm the number until tomorrow.
Updated
May: attack is international
The cyber-attack that has hit the NHS is part of a wider international attack, the prime minister Theresa May has confirmed.
She said there is no evidence that patient data had been compromised.
Updated
One expert who has worked closely with law enforcement says this would be seen as an attack on critical national infrastructure. He says investigators will be examining systems affected by the ransomware to see how badly they are affected and whether they, in turn, can or already have infected other computer systems connected to them.
He adds that the fear is that the ransonware cannot be broken and thus data and files infected are either lost or that the only way to get them back would be to pay the ransom, which would involve giving money to criminals.
If the systems hit by the attack are backed up properly, the infected files can be junked with minimal loss. But ransomware can also drive through systems and hunt down back-up files if they are stored on a system connected to the internet and to the computers originally attacked.
Law enforcement believe that organised crime groups rent out ransomware for short periods so criminals can stage attacks, and organise themselves like a commercial firm: “This is a cash raising business.”
Updated
One question arising from the attack on a sector of critical national infrastructure is whether the government has a policy on paying ransom to cyber hackers.
British government policy in the case of a terrorist attack or of the taking of a person hostage is clear: ransom will not be paid. But it is not clear if a policy exists for the 21st-century cyber equivalent. The lead agency dealing with the attack on the NHS is the National Cyber Security Centre, an arm of GCHQ.
Updated
The New York Times is reporting that 12 countries, including the UK, have been affected.
It reports that the attack struck “computers across a wide swath of Europe and Asia”, saying that Japan, Russia, Turkey, Vietnam and the Philippines are among those affected.
Updated
Prof Alan Woodward, a security expert from the University of Surrey, says the attackers appear to have taken advantage of a chink in the armour of Microsoft XP.
He says the problem may have been exacerbated because organisations have not updated their software with the fixes made available, or are using outdated versions.
From what we can see, it is a piece of ransomware called wanna decryptor. It goes by other names but it emerged in February 2017. Since then, it has been modified and there is evidence that it is spreading using a flaw in the Microsoft network protocol called SMB, which was exposed in the recent dump of exploits that were allegedly from US intelligence agencies.
It is not just the NHS affected: reports suggest it is a global problem. The virulence is likely to be because some organisations have either not applied the patch released by Microsoft, or they are using outdated operating systems (such as XP) that are no longer supported by Microsoft and hence no patch exists.
My concern is that this isn’t the last of this type of attack. Since the dump of the exploits earlier this year, it was obvious that someone was going to enhance their ransomware (or some other form of malware) using the SMB flaw to allow the malware to spread across large networks once a foothold had been established. The disappointing aspect of this is that the patch has been around since March but many organisations have clearly not applied to patch or, worse, they are on something such as XP which is no longer supported and hence cannot be patched.
Wanna Decryptor is actually just a reincarnation of wcry (I first saw it in Feb 2017) but it has been enhanced using the SMB/eternalblue exploit to spread more easily. The concern is that even once this attack dies down it won’t be the only ransomware that has been enhanced in this way. The result is inevitable.
This is not about having some fancy technology in place to protect yourself. It is about the basics: use supported software and keep it updated.
Updated
NHS England have released an updated statement. Dr Anne Rainsberry, the NHS incident director, said:
We’d like to reassure patients that if they need the NHS and it’s an emergency that they should visit A&E or access emergency services in the same way as they normally would and staff will ensure they get the care they need.
More widely, we ask people to use the NHS wisely while we deal with this major incident, which is still ongoing. NHS Digital are investigating the incident and across the NHS we have tried and tested contingency plans to ensure we are able to keep the NHS open for business.
Here’s a little background from my colleagues Damien Gayle, Alexandra Topping and Sarah Marsh. They report the situation as it stood at about 5pm today:
Hospitals across England have been hit by a large-scale cyber-attack, the NHS has confirmed, which has locked staff out of their computers and forced many trusts to divert emergency patients.
The IT systems of NHS sites across the country appear to have been simultaneously hit, with a pop-up message demanding a ransom in exchange for access to the PCs. NHS England has declared a major incident. NHS Digital said it was aware of the problem and would release more details soon.
Details of patient records and appointment schedules, as well as internal phone lines and emails, have all been rendered inaccessible.
It is now thought that some services in Scotland have also been hit, with three GP surgeries in Dumfries and Galloway reporting being affected.
The NHS has declared a major incident after it was hit by a cyber attack that is thought to have affected services across England and Scotland. Staff have been locked out of their computers and many trusts have been forced to divert emergency patients.
We’ll be updating you here as this story develops.
Meanwhile, my colleague Alex Hern and Samuel Gibbs have prepared a Q&A on the attack.
