Cyber attack

gets real


Last week computers from around the world suffered from a cyber attack, which installed ransomware onto machines running Microsoft Windows. The ransomware took control of users’ device and demanded a payment of £230 to restore access. Microsoft reported that the attack had reached over 150 countries across the world and is likely to have affected over 200,000 devices. Luckily the attack was halted by a 22-year-old security researcher from south-west England, who has since been dubbed the ‘accidental hero’.

Since the attack, stories have begun to emerge of the NHS trusts who suffered. In England, 47 NHS trusts reported problems at hospitals and 13 NHS organisations in Scotland were affected. The Guardian noted that “operations were cancelled, X-rays, test results and patient records became unavailable and phones did not work.”

Digital Health were reporting some very real implications beyond the headlines, “Barts, the biggest trust in the NHS, was one of the hardest hit, and on Saturday was reported to be redirecting ambulances away from the three A&E units it runs at Newham, Whipps Cross and the Royal London hospital, while non-urgent operations were cancelled.”

Amongst talk of the next wave of attacks, two main questions spring to mind. How can the NHS prepare itself against such attacks in the future? And how robust is an NHS trust’s crisis communications? Now I’ll leave the technical element up to the techies, but crisis communications are something organisations can plan rigorously for. People often see crisis communication as a subset of public relations and assume it is just about managing reputation. While reputation is an important part, methods of internal communication in a crisis are operational – and must be managed as such. Here are a few brief things to think about:

  • Backup channel to maintain two-way communication when email provisions fail. This is important to log and flag any issues on the ground but to also spread the word when a solution or update is available for staff. 
  • Knowing your roles - having a robust plan for communication staff to ensure that the function is able to respond efficiently and effectively, and broad, well-understood roles which are flexible enough to cope. All crises bring unique challenges!  
  • Relationships - having offline relationships. In the midst of a crisis, the communications team will need to move quickly. It’s therefore, imperative that you are able to find information quickly and access key decision-makers. Rehearse these issues with your Board ahead of time.
  • Control centre – moving quickly to bring the team together and establish a ‘pivot’ control centre to issue announcements, coordinate with partners and manage enquiries
  • Keeping everyone updated – even if there is nothing new to report.  Nature abhors a vacuum.

Our team has helped organisations prepare and work through crises ranging from unexpectedly poor inspection reports to epidemics and terrorist attacks.  In our experience, preparation is the single most important success factor. Why not let us help you “think the unthinkable” – and test your organisations readiness?

Clive Caseley