The Impact of a National Cyberattack Affecting Clinical Trials: The Cancer Trials Ireland Experience

PURPOSE

Cyberattacks are increasing in health care and cause immediate disruption to patient care, have a lasting impact, and compromise scientific integrity of affected clinical trials. On the May 14, 2021, the Irish health service was the victim of a nationwide ransomware attack. Patient care was disrupted across 4,000 locations, including 18 cancer clinical trials units associated with Cancer Trials Ireland (CTI). This report analyses the impact of the cyberattack on the organization and proposes steps to mitigate the impact of future cyberattacks.

METHODS

A questionnaire was distributed to the units within the CTI group; this examined key performance indicators for a period of 4 weeks before, during, and after the attack, and was supplemented by minutes of weekly conference call with CTI units to facilitate information sharing, accelerate mitigation, and support affected units. A total of 10 responses were returned, from three private and seven public hospitals.

RESULTS

The effect of the attack on referrals and enrollment to trials was marked, resulting in a drop of 85% in referrals and 55% in recruitment before recovery. Radiology, radiotherapy, and laboratory systems are heavily reliant on information technology systems. Access to all was affected. Lack of preparedness was highlighted as a significant issue. Of the sites surveyed, two had a preparedness plan in place before the attack, both of these being private institutions. Of the eight institutions where no plan was in place, three now have or are putting a plan in place, whereas no plan is in place at the five remaining sites.

CONCLUSION

The cyberattack had a dramatic and sustained impact on trial conduct and accrual. Increased cybermaturity needs to be embedded in clinical trial logistics and the units conducting them.

INTRODUCTION

According to Cybercrime Magazine, global cybercrime damage in 2021 amounts to $16.4 billion per day, $684.9 million per hour, $11 million per minute, and $190,000 per second.¹ In 2021, more than 40 million medical records were stolen in the United States²; however, the probability of detecting and prosecuting perpetrators of these cyberattacks is only .05%.¹ In recent years, such attacks on health care have increased globally. In New Zealand, they have been labeled as causing more disruption of cancer care than the COVID-19 pandemic,³ because of the former's reliance on information technology for diagnostics and treatment.⁴

CONTEXT

• Key Objective

• Cyberattacks are a growing threat to health care, including clinical trials. Cancer Trials Ireland orchestrates trial conduct in 18 units associated with the Health Service Executive—Ireland National Health Service. The service employs more than 130,000 staff, 15 of whom had dedicated cybersecurity roles. In March 2021, a national cyberattack was initiated, infiltrating the information technology ecosystem of more than 70,000 devices, and in May 2021, a ransomware device was then launched, severely disrupting patient care in 4,000 locations including all trials units.

• Knowledge Generated

• A survey of 10 units demonstrated an 85% fall in referrals and 55% fall in recruitment, with radiation oncology trials most affected. Two of 10 units surveyed had a preparedness plan before the attack, whereas five units still lack such plans. Service disruption persisted for over 5 months after the attack, compromising trial integrity and patient safety.

• Relevance

• Cybermaturity needs to be embedded in clinical trial design and conduct.

In the Republic of Ireland, the Health Service Executive (HSE) is the organization that provides public health services. It is the largest employer in the Irish state, employing more than 130,000 staff, at over 4,000 sites including 54 acute hospitals across the country. Cybersecurity was recorded as a high risk in the corporate risk register in 2019. Fifteen staff were employed in three cybersecurity teams to supervise over 70,000 connected devices.⁵ On the morning of May 14, 2021, at 0250, the HSE received reports from hospitals of an attack on encrypted systems via Conti ransomware.^5,6 In retrospect, the source of the cyberattack originated from the user of a workstation opening an Excel file that was attached to a phishing e-mail sent to the user on March 18, 2021. The workstation's antivirus software program was set to monitor mode and consequently did not block resultant malicious commands. The attack triggered the critical incident process within the HSE resulting in the shutting down of all HSE connected devices, which involved over 1,000 applications, ranging from the cashier tills in the staff canteens to diagnostic equipment in laboratories and radiology departments. Disruption to patient care and normal operations within the HSE was immediate and profound.⁷ Clinical activity, including that associated with clinical trials, was disrupted. This would appear to be the first occurrence of an entire National Health Service being affected by such an attack. The estimated cost of the cyberattack is at least 100 million euros, possibly reaching 500 million euros.⁸

Cancer Trials Ireland (CTI) is the national cooperative group established to enable, support, and oversee the running of clinical trials in the Republic of Ireland. This cancer trials network consists of 18 trials units; these units are integrated into cancer treatment centers across the country in both public, HSE-funded (14 units), and private, HSE-independent (four units), health care facilities. Radiotherapy and chemotherapy trials were enrolling nationally on the eve of the cyberattack. CTI central office was not a victim of the cyberattack. The purpose of this study was to quantify the impact of the attack on the cancer clinical trials network in Ireland and mitigate and prevent their future impacts.

METHODS

A questionnaire was circulated to the 18 clinical trials units within the CTI network. This questionnaire was divided into six sections, as highlighted below.

1. Impact on referrals

2. Impact on enrollment

3. Impact on accessing treatment

4. Impact on detecting/reporting adverse outcomes

5. Impact on surveillance and compliance

6. Redundancies and preparedness within the system

Questions were asked for the 4-week period directly before the cyberattack, the 4 weeks commencing from the day of the cyberattack, and the subsequent 4 weeks. The effect of the cyberattack on the HSE and patients will likely take many years to appreciate fully; examining 4-week periods allowed us to gain a snapshot of the immediate effect and recovery from the attack.

The complete questionnaire is detailed in Table 1.

TABLE 1.

Questionnaire Circulated to Cancer Trials Ireland Sites

RESULTS

Communication

Clear, reliable, and safe communication is central to the functioning of any organization. The communication networks within the public hospitals were powered off once the cyberattack was recognized and the critical incidence process initiated. E-mail, laboratory, and radiology results were inaccessible. Internet access was cut off. Team members and patient contact details were not accessible. Clinical scheduling was lost, and patient records were not retrievable. Increased use of telemedicine, which had been a tool used to great effect during the concurrent COVID-19 pandemic, was no longer functional. Loss of communication functionality varied between clinical trial sites. Sites based in private institutions did not lose access to e-mail; their limitations in communications stemmed from an inability to routinely contact and collaborate with public institutions. Patients were no longer able to get blood tests and diagnostic tests carried out in the community as communication with general practitioners relies on the HSE-managed healthmail network.

Within the public system, time to regaining access to e-mail varied. HSE-funded voluntary hospitals were best able to respond, with one such institution returning regular access to e-mail on the May 19, 2022, 5 days after the attack. Delays within the HSE-managed hospitals were more significant, and return to normal operations was staggered with the latest reported resumption of e-mail access occurring on the July 09, 2021, 8 weeks after the cyberattack. Many private institutions froze access to HSE e-mails for months after the cyberattack for fear of contagion.

A national weekly conference call was initiated by CTI to facilitate information sharing, help affected sites, and assist in communicating with sponsors and regulatory bodies about protocol conduct. Alternative secure communications systems were implemented such as Sillo and ProtonMail. Figure 1 highlights some of the potential key difficulties experienced in the midst of a cyberattack by both staff and patients; our questionnaire was designed to highlight these vulnerabilities.

FIG 1.

Potential impact on patient care in a cyberattack.

Impact on the Functioning of Trials—Referrals for Screening and Enrollment

In the 4 weeks before the cyberattack, 273 patients in total were referred for screening to the 10 trials units surveyed. This fell to 41 patients in the 4-week period during the cyberattack and quickly recovered to 323 patients in the 4 weeks after the attack. Similarly, there was an impact on trial enrollment, 49 patients were enrolled in clinical trials in the 4 weeks before the attack, 22 during the cyberattack, and recovering to 38 patients in the 4 weeks after the attack. There was a drop of 85% in referrals and 55% in recruitment to trials during the cyberattack, and the results are highlighted in Table 2.

TABLE 2.

Direct Impact on Clinical Trials Units

Maintaining Investigational Integrity and Compliance

Protocol adherence was significantly adversely affected. Access to laboratory tests and diagnostic imaging in public hospitals was severely restricted. Initially, only urgent blood tests were processed. Requesting tests and reports pivoted to paper-based systems, resulting in a significantly increased workload and time cost for clinical staff who had to present in person to request and collect reports. Tasks that would normally take seconds to complete electronically took minutes to hours.

Diagnostic imaging capacity was severely affected. In the initial days after the attack, while local secure networks were built, images obtained from scanners could only be viewed on computers directly connected to the imager. They could not be viewed or reported remotely. As a result, each time a scan was carried out, the scanner was out of action until the previous scan had been reported.

Lack of access to historical records, both clinical and radiologic, disabled historical comparisons, and consequently reporting radiologists could not tell if captured images demonstrated response or progression of disease. These uncertainties contributed to the significant drop in ability to screen trial candidates.

Providing sponsors with copies of results and reports was also affected, leading to protocol deviations. One such example is of scans that were copied to compact disc to be couriered to the sponsor; some scans that had been documented as redacted were in fact not when viewed by the sponsor, resulting in a major protocol deviation and General Data Protection Regulation breach. Chemotherapy treatments were unaffected as they involved written prescriptions; however, significant disruption occurred in radiotherapy treatments, and an overview of the responses is highlighted in Table 3.

TABLE 3.

Impact on Surveillance, Compliance, and Redundancies

Redundancy

The survey demonstrated a lack of system redundancy and preparedness.

Of the sites surveyed, two had a preparedness plan in place before the cyberattack. Both of these were private institutions. Of the remaining institutions surveyed, no preparedness plan was in place, and only three now have or are putting one in place. No preparedness plan is in place or in preparation in the five remaining sites. The results are highlighted in Table 3.

Return to Normality

Lack of preparedness had a serious impact on the return to normal functioning. There was a wide variation noted, particularly marked between the public and private institutions.

Trials units attached to private institutions experienced minimal impact; their biggest issue was that patients were unable to access diagnostic tests in the community, instead having to be carried out onsite.

There was a wide discrepancy in the public system, particularly noted between trials units located in hospitals directly managed by the HSE and HSE-funded voluntary hospitals. Some had minimal disruptions lasting < 24 hours, whereas others had ongoing disruptions for months. At Cork University Hospital, delayed imaging reporting persisted until January 2022.

DISCUSSION

The national cyberattack led to significant disruption to clinical trials, resulting in dramatic falls in accrual and challenges to maintaining patient safety and scientific integrity. The impact was variable, with private hospitals being least affected. Resolution for those affected lasted months. A significant effort was required to ensure patient safety, with accurate paper-based records and logs being created to replace electronic records. An additional concern was the need to ensure that patient data were not corrupted in a manner that would compromise patient care and trial integrity.⁹ These significant efforts ensured that there was no change in adverse outcomes observed during this period.

On the May 20, 2021 (6 days after the HSE ransomware attack), the Federal Bureau of Investigation identified at least 16 Conti ransomware attacks targeting US health care facilities.¹⁰ On the basis of a Medical Information Technology Advisors Threat Information Platform analysis of incidents, the number of business e-mail compromise and ransomware incidents from phishing or dark web compromise credentials is growing and is quickly becoming the number one risk for health care organizations.^4,11 In at least 72% of ransomware incidents, victim data are leaked.¹² In the HSE cyberattack, the attacker operated for 8 weeks throughout the HSE's information technology (IT) environment, compromising servers, exfiltrating data, and moving laterally between hospitals and then detonated the ransomware. To date, compromised data have been stolen in the attack on 94,800 patients and 18,200 staff.¹³ It is unclear if patients enrolled in CTI associated trials are among these patients. Cyber-preparedness is becoming an increasing patient safety prerogative in health care as service disruption compromises timely treatment, reducing cancer survival.^14-16 Cybersecurity can save lives, but the increasing global spend on cybersecurity estimated at $150 billion¹⁷ represents a significant opportunity cost to society.

Cyberattacks occur in seconds but have impacts lasting for months and longer.^18-20 Delivery of cancer care is particularly susceptible to IT disruptions, with both immediate and long-term consequences for patients who are dependent on IT systems for timely diagnostics and regular administration of systemic anticancer treatments. The impact of the present attack on radiotherapy services has been analyzed by Flavin et al.⁷ Because of the inability to retrieve on treatment records, 513 patients nationally had their radiation treatment interrupted. Their report highlighted the lack of warning, precluding advance planning, resulting in severe service disruption and mitigation lasting 2 weeks with staff exhaustion. Return of consistent access to picture archiving took 4 months, and remote access restoration took 5 months. In Ireland, chemotherapy prescribing was less affected as it is predominately paper-based. However, impaired access to patient records and appointment schedules and diagnostic tests created risks for patients as outlined in our study. Delays in scheduled surgical treatment resulted from lack of access to diagnostics and records, compounding delays already experienced due to the COVID-19 pandemic.

The COVID-19 pandemic has been a major threat to scientific trial integrity, with staffing shortfalls and patient infection–related disruption impacting on treatment scheduling and compliance with follow-up assessments.²¹ In this study, similar challenges were noted to trial integrity with disruption of treatment schedules, delays in diagnostics and a dramatic fall in accruals. In response to the COVID-19 pandemic, multiple professional bodies^22,23 and trial organizations^24-27 have advocated for more pragmatic trial design, greater flexibility in follow-up schedules, and increased reliance on virtual follow and digital technologies to bring trials near the patient and reduce the time and financial toxicity associated with onerous, rigid scheduling. Many of these suggested changes are information technology–dependent. Given the global rise in health care–related cybercrime,²⁸ a routine aspect of clinical trial conduct needs to be a cybercrime risk assessment of clinical trials units. This process could be integrated into trial feasibility assessments by sponsors and would accelerate cybersecurity in health care.

As emphasized in the chronology in this report, the greatest vulnerability to ever more complex network systems is human beings who use computers. An independently commissioned report on the cyberattack highlighted the lack of cybermaturity in the HSE.⁶ Under-resourcing was multifactorial, including dedicated staffing and outdated Windows 7 operating systems in over 30,000 devices. Our study, in addition, highlights the discrepancies between the public and private systems in Irish health care. Those least affected and best able to respond were clinical trials units based in private institutions. Of those based in public institutions, those least affected and best equipped to maintain clinical services were voluntary hospitals that are directly funded but not under the direct governance of the HSE. They are not fully reliant on the national health network for their day-to-day functioning, with independent servers and applications for e-mail, patient management systems, and diagnostics. In the second instance, health care facilities that relied on paper-based records, booking databases, and diagnostic requests were well equipped to maintain services in the face of the cyberattack. Worryingly, as highlighted in this report, many of the sites that did not have a plan before the cyberattack still do not have one in preparation or in place.

The impact of this cyberattack on cancer care was profound for patients and health care workers. Its timing at the end of the third wave of the COVID-19 pandemic severely challenged the resilience of the already exhausted staff.^29,30 This impact has prompted CTI to reflect on learning points from the ransomware attack to mitigate against further events. These strategies range from increased awareness of cyber-vulnerability in our communities to firewalled systems and harmonized diagnostic platforms (Tables 4 and 5). Embedding cyber-awareness into the clinical trial arena is a necessary reality. Similar to other reports, our experience demonstrates the significant disruption that an attack can cause.^18-20 Our new reality demonstrates the need for constant vigilance and the integration of cyber-preparedness into health care including clinical trial conduct in a similar manner to as we are for fire and major accidents.²⁸

TABLE 4.

Summary of Lessons to Be Learned for Clinical Trials Units

TABLE 5.

Recommendations for Cancer Trials Organizations

AUTHOR CONTRIBUTIONS

Conception and design: Harry Harvey, Verena Murphy, Ailish Daly, Eibhlin Mulroe, Seamus O’Reilly

Provision of study materials or patients: Gavin Lawler, Michelle Connolly

Collection and assembly of data: Harry Harvey, Verena Murphy, Jo Ballot, Gavin Lawler, Michelle Connolly, Emma Noone, Mary Grace Kelly, Ashley Bazin

Data analysis and interpretation: Harry Harvey, Hailey Carroll, Erica Bennett, Eibhlin Mulroe, Ray McDermott, Seamus O’Reilly

Manuscript writing: All authors

Final approval of manuscript: All authors

Accountable for all aspects of the work: All authors

AUTHORS' DISCLOSURES OF POTENTIAL CONFLICTS OF INTEREST

The following represents disclosure information provided by authors of this manuscript. All relationships are considered compensated unless otherwise noted. Relationships are self-held unless noted. I = Immediate Family Member, Inst = My Institution. Relationships may not relate to the subject matter of this manuscript. For more information about ASCO's conflict of interest policy, please refer to www.asco.org/rwc or ascopubs.org/cci/author-center.

Open Payments is a public database containing information reported by companies about payments made to US-licensed physicians (Open Payments).