A virus that attacked 4,700 PCs and saw three London hospitals left without email or internet access for days was "entirely avoidable" says an independent security review.
The PCs at St. Bartholomew's, the Royal London Hospital and the London Chest Hospital were infected with Mytob, a mass-mailing worm also known as MyDoom, during November. Emergency patients were temporarily diverted to other facilities, but officials said no personal data was lost.
The review concluded there was a "substantive failure" in the medical group's information governance processes. Antivirus software on the PCs was updated on a daily basis prior to the attack, but the software was not configured correctly on some PCs.
"This left a 'back door' for the virus to infiltrate the network," the review said.
Mytob was "introduced accidentally" into the hospitals' networks and there was no "malicious intent," the review said.
The hospitals' PCs were running McAfee 8.5 antivirus software, a product also known as VirusScan Enterprise. Most antivirus products - including that McAfee product - can detect and remove Mytob, but the malware continues to circulate on the internet despite its discovery in early 2005.
Most PCs were cleared of the infection and working again by early December.
The hospitals are now embarking on a program to shore up management systems and processes, the review said. The program calls for additional staff training and changes to command and control structures, among other measures, and should be complete by April.
Although patients were not severely affected, the review notes "this incident could have threatened the well-being of patients and morale of staff as well as the long-term reputation" of the hospitals.