The Impact of a National Cyberattack Affecting Clinical Trials: The Cancer Trials Ireland Experience

Cyberattacks are increasing in health care and cause immediate disruption to patient care, have a lasting impact, and compromise scientific integrity of affected clinical trials. On the May 14, 2021, the Irish health service was the victim of a nationwide ransomware attack. Patient care was disrupted across 4,000 locations, including 18 cancer clinical trials units associated with Cancer Trials Ireland (CTI). This report analyses the impact of the cyberattack on the organization and proposes steps to mitigate the impact of future cyberattacks.

A questionnaire was distributed to the units within the CTI group; this examined key performance indicators for a period of 4 weeks before, during, and after the attack, and was supplemented by minutes of weekly conference call with CTI units to facilitate information sharing, accelerate mitigation, and support affected units. A total of 10 responses were returned, from three private and seven public hospitals.

The effect of the attack on referrals and enrollment to trials was marked, resulting in a drop of 85% in referrals and 55% in recruitment before recovery. Radiology, radiotherapy, and laboratory systems are heavily reliant on information technology systems. Access to all was affected. Lack of preparedness was highlighted as a significant issue. Of the sites surveyed, two had a preparedness plan in place before the attack, both of these being private institutions. Of the eight institutions where no plan was in place, three now have or are putting a plan in place, whereas no plan is in place at the five remaining sites.

The cyberattack had a dramatic and sustained impact on trial conduct and accrual. Increased cybermaturity needs to be embedded in clinical trial logistics and the units conducting them.