A coordinated cyber-attack has forced 100 UK hospitals to abandon digital systems and revert to pen and paper, according to live reports. The assault, which appears to be state-sponsored, targeted critical NHS infrastructure, encrypting patient records, appointment systems, and even surgical scheduling software. The attack has paralysed operations, with A&E departments reporting delays of up to 12 hours and elective surgeries cancelled indefinitely. Notably, the attackers have not yet issued a ransom demand, raising fears that the goal was pure disruption or data destruction.
The shift to analogue processes has been chaotic but not entirely unprecedented. Several trusts had retained paper-based contingency protocols post-WannaCry, but the scale of this incident has exposed a deeper malaise. Trusts are now competing for limited supplies of paper forms, while exhausted staff manually transcribe prescription charts and bed allocations. Patients have been turned away from non-emergency services, and GP referrals have ground to a halt.
The government has convened an emergency Cobra meeting, with the Health Secretary calling for an immediate, cross-departmental investigation. But the attacks have reignited a bitter political debate about the neglect of public sector cybersecurity. The NHS has long been a target, its sprawling legacy systems a patchwork of vulnerabilities. While the pandemic accelerated some digitisation, it also deepened cracks: underinvestment in encryption, outdated Windows XP machines, and a lack of basic cyber hygiene.
This event is a stark reminder that digitisation without security is a house of cards. The true cost is not just the immediate chaos but the erosion of trust in a system that already struggles to inspire confidence. We are witnessing the real-world consequences of our collective failure to treat cybersecurity as a public good, not a technical afterthought. The debate must now shift from whether to modernise, to how quickly we can build a resilient, ethically grounded digital NHS. The pen-and-paper interlude is a stopgap, not a solution.
