NHS trusts are experiencing disruption one week after a cyber-attack caused havoc in more than 150 countries.
The unprecedented ransomware breach froze computers across the health service last Friday, with hackers threatening to delete files unless a ransom was paid.
Operations and clinic appointments were cancelled and patients were still being diverted from accident and emergency departments on Thursday.
However, NHS England confirmed on Friday that ambulances were no longer being diverted to unaffected hospitals.
Dr Anne Rainsberry, the regional director for London at NHS England, said: “There is still some disruption in a small number of areas but most patients are being treated normally. We are grateful for the hard work of staff at trusts and GP practices who are still suffering IT issues but have found ways to work around this, as well as the patience of people who have been affected.”
A pre-inquest review on Friday into hearings on the deaths of the perpetrator and the victims of the Westminster terrorist attack in March heard Barts Health NHS trust, the health service’s largest trust, was still unable to access data.
Lawyers representing the trust, which treated a victim, Andreea Cristea, told the hearing it was unable to access witness statements because of ongoing IT disruption. The trust would provide the statements once the disruption had eased.
The ransomware, WannaCry, also hit large organisations such as Telefónica, Deutsche Bahn and FedEx as it rapidly spread around the globe.
French researchers have found a way to decrypt Windows computers infected with WannaCry without having to pay the cyber criminals.
Their tools, wannakey and wanakiwi, are able to recover the key used to encrypt the files if it is still in the computer’s memory. It can then be used to restore the encrypted files on infected computers.
But the security researchers warned that the tools would only work if the computer had not been rebooted. Wannakey works for Windows XP and, as Adrien Guinet, a security expert and developer of the tool, said: “You need some luck for this to work and so it might not work in every case.”
Wanakiwi, developed by Benjamin Delpy – who worked on it during in his spare time outside his day job at the Banque de France – has been shown to work on Windows XP and Windows 7, as well as Windows server 2003, and will probably work on Windows Vista and other variants of Windows affected by WannaCry, according to Delpy.
Matthieu Suiche, an internationally renowned hacker who collaborated with Guinet and Delpy, said: “This method relies on finding prime numbers in memory if the memory hasn’t be reused. This means that after a certain period of time memory may get reused and those prime numbers may be erased. Also, this means the infected machine should not have been rebooted.”
The tools, verified by several independent security researchers, are described as a last-chance way for technicians to save files that are scheduled to be lost for ever, as the deadline for paying the ransom looms for those computers infected a week ago.
Suiche said: “Today [19 May] marks the seventh infection day [started on the 12th] which means that many users would potentially lose their files forever from today as stated in the initial infection window. The clock is currently ticking for many users around the world.”
