Impact of Conti ransomware attack on cancer trials Ireland sites.

Abstract

e13614 Background: Cancer trials in Ireland are conducted in both public Health Service Executive (HSE) and private hospitals and are overseen by Cancer Trials Ireland (CTI). On the 14th of May 2021 the Irish National HSE was the victim of a “Conti” ransomware attack. The attack triggered a “Critical Incident Process,” and the shutting down of all HSE IT systems at a national level. Disruption to patient care across the HSE’s 4000 locations, 54 acute hospitals, and 70,000 connected devices was drastic, immediate and without warning. Methods: The purpose of this study is to quantify the impact of the attack on the clinical trials network. A questionnaire was distributed by CTI to the 16 trials units within the group, this examined patient referrals and key performance indexes for a period of 4 weeks; prior, during, and after the attack. A total of 10 responses were returned, with a split of 3 private and 7 HSE hospitals. Results: The effect of the attack on referrals and enrollment to clinical trials was marked. In the 4 weeks prior to the attack 273 patients in total were referred to the trials units for screening, this fell to 41 patients in the 4 weeks during and recovering to 323, 4 weeks after. 49 patients were enrolled in trials prior the attack, 22 during and 38 after, a drop of 85% in referrals and 55% in recruitment to trials before recovery. Radiotherapy delivery was interrupted for patients on treatment or delayed for those initiating it. Radiology, lab systems and radiotherapy are heavily reliant on IT systems. Access to all was impacted, with only urgent diagnostic tests being carried out. Requesting tests and reports pivoted to a paper based systems. With staff having to present in person to request and collect reports. Patient safety was prioritized, with accurate paper records and logs in lieu of electronic records. Scientific integrity of trials involving combined modality or radiotherapy was compromised in HSE hospitals. No change in adverse outcomes was reported across all units surveyed before, during and after the attack. Normal access to emails in sites that were impacted ranged from days at a minimum to 6 weeks in the worst affected centers. Normal access to radiology and lab tests took on average 26 and 32 days respectively. Conclusions: A significant issue highlighted by the cyber-attack was the lack of redundancy in the IT systems used throughout Irish hospitals on a daily basis and a lack of a plan when these systems fail. Of the 10 sites surveyed, 2 had a preparedness plan in place prior to the attack, both of these private institutions. Of the 8 institutions where no plan was in place only 3 now have or are putting a plan in place, no plan is in place in the 5 remaining sites. At this time one HSE hospital has been subject to a repeat ransomware attack and patient data from another has been released on the dark web. Reviewing the impact of the cyber attack on CTI highlights the usefulness of preparedness, with units that had a plan in place prior to the attack least affected overall.