Microsoft ended support for the OS in 2014, but 11 of 14 Scottish trusts have still not updated

The majority of Scottish NHS boards are still using Windows XP, nearly a year after the outdated OS was hit by the devastating WannaCry cyber-attack.

A ransomware attack in May 2017, which exploited a vulnerability in XP, infected NHS computers and caused the cancellations of more than 19,000 medical appointments.

But 11 out of 14 regional NHS boards are still running on the outdated OS, a Freedom of Information (FoI) request by The Scotsman revealed, leaving hundreds of facilities open to another attack.

Microsoft ended support for XP back in April 2014, with the last security update released in 2008.

The developer released a patch in May to combat the WannaCry attack, but continued to urge users to upgrade to a more secure OS.

These latest figures show that despite last year’s major attack, which was foiled by a British researcher who discovered a kill switch, NHS Scotland systems are still at risk.

Another FoI request by Digital Health Age, released in December last year, found that 60% of NHS England boards were also using XP.

The report noted that 88 of 192 trusts were still operating the system at the time.

It isn’t clear whether these trusts have since upgraded, but the NHS did confirm it was taking steps to update OS systems.

This comes as McAfee Threat Labs released a report this month, in which it claimed hackers are “disproportionately” attacking the healthcare system.

Raj Samani, chief scientist at McAfee, told The Daily Swig that cyber-attacks are becoming increasingly common across the health industry, which is perceived as “low-hanging fruit”.

He said: “They are disproportionately attacking the healthcare sector and they do that because it’s perceived as a weaker target.
“It’s perceived as low-hanging fruit, so they do that because sadly what happens is when people pay they continue to do this.

“Criminals will only go after something if there’s a return on investment, if they can make money out of it.”
McAfee revealed that there are around 478 new cyber-threats recorded every minute, around eight per second.

The team also recorded a 35% rise in new ransomware last year, and fileless malware using Microsoft’s PowerShell software grew by 267% in the fourth quarter of 2017.