Five hospitals in the Australian state of Queensland have suffered IT outages after a botched attempt to patch their systems against ransomware. On 25 May, Queensland Health Minister Cameron Dick provided some details to The Courier-Mail about the failures:
"Over the course of that weekend as part of protecting our systems from cyber-attack, a series of security patches provided by software owners such as Microsoft, Cerner and Citrix were loaded to further protect Queensland Health systems from attack. Yesterday I received advice from the Chief Executive of eHealth Queensland, Dr Richard Ashby, that while those patches have protected the integrity of our systems and data, it appears these protections may be making logging on and off the integrated electronic medical record system difficult for some users."
He goes on to explain that the outages, which were affecting the Princess Alexandra and the Lady Cilento Children’s hospitals in Brisbane along with the Cairns Base, Mackay, and Townsville hospitals, amounted to a "hiccup... [that] happened because we took extra care to defend against the ransomware attack that occurred around the world on the 13th of May." Dick is referring to WannaCry, a family of ransomware which attacked the United Kingdom's National Health Service (NHS), the telecommunications provider Telefonica, and more than 300,000 organizations in over 150 countries as of this writing. The threat latched onto its victims beginning on 12 May by exploiting a Windows vulnerability using attack code developed by the National Security Agency (NSA) and leaked by the Shadow Brokers. As disclosed by a bot monitoring WannaCry ransom payments, victims have submitted only 303 payments to the Bitcoin wallets attached to the ransomware attack. WannaCry's handlers have so far collected 49.87775239 BTC ($134,801.86). https://twitter.com/actual_ransom/status/867681697835470848 The software updates implemented by the Queensland hospitals made "logging on and off the ieMR (integrated electronic medical record) system difficult for some users." 500 doctors and nurses were unable to log in at the Princess Alexandra Hospital as of 25 May. The issues had also delayed 22 outpatient appointments and triggered a "Code Yellow" at Cairns Hospital, a signal which usually indicates the hospital has reached full capacity or has lost essential services like software systems. Even so, Dick told The Cairns Post that the outages have not affected surgeries or caused any larger problems:
"While this is causing inconvenience to staff, I’m advised that there have been no patient safety issues and our hospitals are operating as usual. While a large number of users remain on the system, full downtime procedures, for which staff have been trained and are ready, including reverting to paper systems as necessary, are operating as required."
The IT failures have caused longer wait times in patient admission and discharge. At this time, it's unclear how long the outages will last, though Dick told Parliament they could last for at least a week.
