New version of decryption tool developed as progress made on restoring health systems
File That Version On More The Of Has Hit A Cyberattack From A The Developed, Been The The Confirmed That Health Picture On Tool Than Twitter Decryption New Health Week Minister Service
A new version of a decryption tool has been developed by the HSE and IT experts, Health Minister Stephen Donnelly said.
Mr Donnelly said “a structured and controlled deployment” is underway across “the core network and devices across the system”.
The minister confirmed the news on Twitter more than a week on from the cyberattack that hit the health service.
The head of the HSE previously warned that the fallout from the ransomware attack by an organised criminal gang will continue for some weeks.
The HSE and IT experts have developed and tested a new version of the decryption tool, and a structured and controlled deployment is now underway across the core network and devices across the system.
— Stephen Donnelly (@DonnellyStephen) May 22, 2021
Taoiseach Micheál Martin confirmed that the Government did not pay a ransom or use diplomatic channels to obtain the decryption key.
Mr Donnelly said on Twitter that progress was being made on restoring health systems.
The Health Minister said: “We are making progress on restoring health systems which is important to our patients who need the services, and also to the staff across the service who are doing ferocious work after 14 months of intense work on Covid-19.
“The HSE and IT experts have developed and tested a new version of the decryption tool, and a structured and controlled deployment is now underway across the core network and devices across the system.”
Mr Donnelly said that the levels of disruption that were experienced last week are expected to be similar this week.
He added that the HSE “has been directly informing digital platforms of the High Court order” preventing any individual or business “from sharing, processing, or selling any information secured as a result of the cyber-attack”.
Mr Donnelly said that if any member of the public receives “any suspicious calls, texts or other contacts seeking personal or banking details” they should contact gardaí.
He also paid tribute to healthcare staff who are doing their best at this time — "it is appreciated”.
“We are making progress but it will take time to restore systems. Everything that can be done is being done at this time.”
Meanwhile, Dr Seán McSweeney, the head of department in computer science at Munster Technological University, said it wasn’t “exceptionally unusual” that the hackers had provided the key.
Speaking to on Saturday, he said it is not unprecedented for the threat actor to hand over decryption software.
“My understanding is the tool was verified yesterday to be genuine, however, there are concerns within the National Cyber Security Centre and their contractors that there are back doors to this tool.
“Additionally, they have been offered a piece of software by a company known as Emsisoft that will extract the decryption key from the tool that Wizard Spider have offered them, and this is a much safer, more efficient approach to decrypting these scrambled files.”
He shared the concerns of the Taoiseach and HSE chief Paul Reid that the process for getting systems up and running again will be painstakingly slow.
The ransomware attack resulted in the HSE having to close down all its IT services, causing widespread delays and the cancellation of appointments at hospitals across the country.
The number of appointments in some areas of the system has dropped by 80% as health workers grapple with paper records while work continues to recover IT systems.
The NCSC and the Garda National Cyber Crime Bureau are carrying out an international investigation into the attack.