Cyber attacks the new normal

EMAIL access for Barwon Health staff is still being restored more than a month after it was hit by a ransomware attack.

A cyber security expert says it is one of the longest-lasting recovery periods from a cyber incident in Australia’s digital age, and warned the attacks are the “new normal”.

The health service says it is “business as usual” as a “secure environment” continues to be restored.

Barwon Health was forced offline on October 1, when it was caught in an attack that affected multiple health services in southwest Victoria and Gippsland.

Initially, some outpatient appointments and surgeries were cancelled, but services have been restored over the past month.

Spokeswoman Kate Bibby said Barwon Health services were now operating normally.

“Email access for staff is being progressively restored, giving staff internal communications as we continue to restore the secure environment that is necessary for external communications,” Ms Bibby said.

“The recovery process has been thorough in order to protect our systems from further cyber security risks.

“It is business as usual and we are confident our staff can continue to deliver high-quality care.”

The attack came just months after a report by the Victorian Auditor-General’s Office exposed flaws in Barwon Health’s cyber security.

The report saw VAGO hack into three health services, including Barwon Health. It concluded, across audited services, staff awareness of data security was low and there were key weaknesses in security.

In the months following the report, Barwon Health spent more than $100,000 on cyber security.

Matt Warren, the deputy director of Deakin University’s cyber security research centre, said in Australia’s history, the attack was “up there” with cyber incidents it has taken the longest to recover from.

Globally, healthcare services and organisations did not tend to invest in cyber security, he said.

Prof Warren said the State Government had demonstrated resilience and the Federal Government had shown support following the October 1 attack. But he warned that this wasn’t going to be the last cyber incident involving Victoria or healthcare.

“It’s a phenomenon we’re seeing around the world that healthcare organisations are vulnerable to cyber incidents,” Prof Warren said.

“I’m afraid this literally is the new normal.”