A National Cyberattack Affecting Radiation Therapy: The Irish Experience

Abstract

On Friday, May 14, 2021, the Health Service Executive, the organization providing public health services in the Republic of Ireland, was the victim of a significant cyberattack on its information technology systems. All systems were subsequently shut down to prevent further damage and to allow cybersecurity experts to investigate the attack. As a result, oncology services were severely disrupted, with the cessation of radiation therapy treatments in all public radiation therapy departments. Ireland has 5 large public and 6 smaller private radiation therapy centers in total. Because of the widespread adoption of electronic medical records in radiation therapy departments, it wasn't possible to retrieve patient details of those who were undergoing radiation therapy at the time of the cyberattack. In total, 513 patients nationally had their radiation therapy interrupted. A national radiation therapy cyberattack response team was formed immediately to oversee the response to the attack. The immediate concerns were radiation therapy emergencies and category 1 patients where gaps in treatment would have an adverse effect on outcome. Communication with patients and the public was also established as a priority and agreements were reached with the private sector for the treatment of patients affected by the cyberattack. The national media was used to alert patients of the need to communicate with their radiation therapy department. Dedicated phone lines were established. Locally, radiation therapy departments held daily crisis meetings with key staff members, including information technology personnel. Individual centers employed different technologies for treatment planning and data storage, so local solutions to the cyberattack to reestablish radiation therapy for patients were developed. In addition, national documentation on prioritization of patients to resume treatment was produced and a national approach was made to compensate for gaps in treatment caused by the attack. All 5 centers had reestablished radiation therapy by May 30, although there has been a long aftermath to the cyberattack. In this article, we provide an overview of the effects of the cyberattack on our national radiation therapy service and our strategy to resume patient treatment in a timely fashion.

Fig. 1

Systems that were shut down due to the cyberattack. Abbreviations: EMRs = electronic medical records; OIS = oncology information system; PACS = picture archiving and communications systems; TPS = treatment planning system.

Fig. 2

Implications of lost services.

Fig. 3

Local management strategies to mitigate against the adverse effects of the cyberattack.

Fig. 4

Timeline of events during the national cyberattack.

Fig. 5

The National Cancer Control Programme's capacity escalation plan as its radiation oncology response to the cyberattack. Abbreviations: BCC = basal cell carcinoma; RAI = radioactive iodine.

Fig. 5

The National Cancer Control Programme's capacity escalation plan as its radiation oncology response to the cyberattack. Abbreviations: BCC = basal cell carcinoma; RAI = radioactive iodine.

Fig. 6

National Cancer Control Programme (NCCP) risk assessment tool for radiation oncology during the Health Service Executive (HSE) information technology (IT) cyberattack.

Fig. 7

National Cancer Control Programme–identified risks during radiation therapy cyberattack.