Written question WQ86488

In Wales, the cyber incident on 4 August 2022 impacted the NHS 111 data transfer service to out-of-hours GP services and mental health services in Wales through the Wales Community Care Information Systems (WCCIS) as part of a supplier software system.

The impact to Welsh citizens was low as effective contingency measures were in place to ensure seamless delivery of care. The primary impact was experienced in England with lesser impacts felt by Scotland and Northern Ireland.

As part of work to implement the Security of Network and Information Systems Regulations 2018 (the NIS Regulations), our flagship NHS Wales Cyber Resilience Unit (CRU) has assessed the cyber resilience of NHS Wales organisations and is supporting health boards and NHS trusts to remediate any identified issues. Consideration of standard contractual clauses in supply chain management to make explicit responsibilities and how this could potentially be integrated into the CRU and NHS Wales is ongoing as part of general cyber resilience management.

We have funded a new cybersecurity e-learning programme for all NHS Wales staff, which will help to bolster security and resilience of the NHS at a time of heightened cyber threat. To maximise impact, the completion of training by all staff has been added as a target in the chair’s objectives for each NHS Wales organisation and each organisation has been encouraged to reflect on the lessons learned from past cyber attacks as part of reviewing local risk management strategies.

All those in Welsh Government, who are involved in supporting the response to and recovery from the recent cyber incident, will be participating in internal and external debrief sessions to further consolidate and strengthen lessons learned.