Revealed: The seven hospitals struggling to recover from ransomware attack

It comes as security experts say a fresh wave of disruption is “likely” in the coming days, with uncertainty around the readiness of primary care to deal with the attack.

The seven hospitals receiving extra support from NHS Digital and NHS England are:

• The Royal London (Barts Health Trust)
• Colchester General Hospital (Colchester Hospital University Foundation Trust)
• Lister Hospital (East and North Herts Trust)
• James Paget University Hospital (James Paget University Hospitals FT)
• Broomfield Hospital (Mid Essex Trust)
• West Cumberland Hospital (North Cumbria University Hospitals Trust)
• Basingstoke and North Hampshire Hospital (Hampshire Hospitals FT)

NHS England said that in total 47 trusts providing urgent and emergency care have been infected, although HSJ knows of at least one further provider - Birmingham Community Healthcare Foundation Trust - which has also fallen victim to the attack.

Most of the 47 have not needed intensive support and are not expecting to cancel operations or appointments this week.

Recovery has been slower at seven sites and NHS England said all had asked for national support. It is not yet known why they were hit harder by the attack.

As the full extent of the chaos caused by the ransomware attack becomes clear, it has emerged that one trust that was not infected still had to declare a major incident due to the number of patients being diverted from a neighbour whose systems had been compromised. 

The National Cyber Security Centre has warned that the ransomware is likely to unleash fresh havoc this week.

HSJ understands that there are concerns about how primary care may be affected, as many practices have been closed since the ransomware began to spread on Friday afternoon. One national source said on Sunday, “we just don’t know what is going to happen tomorrow morning when GPs turn on their computers.”

NHS England and NHS Digital have been working throughout the weekend to ensure practices have installed a software “patch” which ensures they are not vulnerable to the ransomware.

A statement published by the NCSC on Sunday afternoon said there have not been any new attacks since Friday. But, it said, “it is important to understand that the way these attacks work means that compromises of machines and networks that have already occurred may not yet have been detected, and that existing infections from the malware can spread within networks.

“This means that as a new working week begins it is likely, in the UK and elsewhere, that further cases of ransomware may come to light, possibly at a significant scale.”

The agency warned there could be further attacks “of this type and on this scale… though we have no specific evidence that this is the case”.

The statement said organisations should keep their security patches up to date, use proper antivirus software, and back up their data.

Some trusts, such as the Royal Berkshire and South Warwickshire foundation trusts, which were infected with ransomware on Friday are expecting to operate as normal this week.

However other parts of the service will continue to be disrupted. Barts Health has said that while all its hospitals are open for emergency care, it will be “reducing the volume of planned services on Monday”. It has not given figures for how many operations or appointments it expects will be cancelled or delayed.

NHS England have advised patients to attend their appointments unless told otherwise.

There are not yet any figures available for how many operations and appointments have been cancelled or delayed nationally.

As the full extent of the chaos caused by the ransomware attack becomes clear, it has emerged that one trust that was not infected still had to declare a major incident due to the number of patients being diverted from a neighbour whose systems had been compromised.

The National Cyber Security Centre has warned that the ransomware is likely unleash fresh havoc this week.

HSJ understands that there are particular concerns in the NHS around primary care, as many practices have been closed since the ransomware began to spread on Friday afternoon. One national source said on Sunday, “we just don’t know what is going to happen tomorrow morning when GPs turn on their computers.”

HSJ has been told NHS England and NHS Digital have been working throughout the weekend to ensure practices have installed a “patch” which ensures they are not vulnerable to the ransomware.

A statement published by the NCSC on Sunday afternoon said there have not been any new attacks since Friday. But, it said, “it is important to understand that the way these attacks work means that compromises of machines and networks that have already occurred may not yet have been detected, and that existing infections from the malware can spread within networks.

“This means that as a new working week begins it is likely, in the UK and elsewhere, that further cases of ransomware may come to light, possibly at a significant scale.”

The agency warned there could be further attacks “of this type and on this scale… though we have no specific evidence that this is the case”.

The statement said organisations should keep their security patches up to date, use proper antivirus software, and back up their data.

Some trusts, such as the Royal Berkshire and South Warwickshire foundation trusts, which were infected with ransomware on Friday are expecting to operate as normal this week.

However other parts of the service will continue to be disrupted. Barts Health has said that while all its hospitals are open for emergency care, it will be “reducing the volume of planned services on Monday”. It has not given figures for how many operations or appointments it expects will be cancelled or delayed.

NHS England have advised patients to attend their appointments unless told otherwise.