1730P - Dealing with digital paralysis: Surviving a cyberattack in a cancer centre

Background

A constellation of a large attack surface of interconnected devices and cyberimmaturity renders healthcare ripe to cybercrime. These vulnerabilities and their consequences will be magnified by the exponential growth in artificial intelligence. We assess the impact and implications of a cyberattack on a national cancer centre.

Methods

On 14 May 2021 (day 0), the first national healthcare ransomware attack occurred within which all hospitals including Cork University Hospital (CUH) Cancer Centre was implicated. Contingency plans were only present in laboratory services who had previously experience information technology (IT) failures. Departmental handwritten logs of activity and responses for 700 days after the attack were reviewed.

Results

Following the attack, all IT systems were shut down. No hospital cyberattack emergency plan was in place. Within CUH, on day 0, all radiotherapy (RT) treatment stopped, outpatient activity fell by 50%, and elective surgery stopped. Haematology, biochemistry and radiology capacity fell by 90% (daily sample deficit (DSD) 2700 samples), 75% (DSD 2,250 samples), and 90% (100% mammography/PETscan) respectively. Histopathology reporting times doubled (7 to 15 days). or paused IT links. Outsourcing of radiology and radiotherapy (RT) commenced, alternative communication networks (e.g., proton mail; Siilo) were utilised and national conference calls for RT and clinical trials were established. 136 patients had interrupted RT: median gap day 6 days category 1, 10 days for remaining patients. By day 28, e-mail communication was restored. By day 210, reporting and data storage backlogs were cleared and over 2000 computers were checked/replaced by the Irish Army. Notification of patients and staff whose data was compromised is ongoing (day 720).

Conclusions

Cyberattacks have rapid, profound and protracted impacts. While laboratory and diagnostic deficits were readily quantified, the impact of disrupted/delayed care on patient outcomes is less readily quantifiable but likely to be much greater. As criminals and nation states weaponize the internet, cyberawareness and cyberattack plans need to be embedded in healthcare.

Clinical trial identification

Editorial acknowledgement

Legal entity responsible for the study

The authors.

Funding

Has not received any funding.

Disclosure

R.J. Keogh: Financial Interests, Other, Travel, Accommodations, Expenses: MSD. All other authors have declared no conflicts of interest.