Statement: Global Ransomware Incident

The Presiding Officer (Ken Macintosh): The next item of business is a statement by Shona Robison on the impact on and response by the national health service in Scotland to the global ransomware incident. The cabinet secretary will take questions at the end of her statement, so there should be no interventions or interruptions.

14:04
... ... ...

Stewart Stevenson (Banffshire and Buchan Coast) (SNP): Given that the opportunity for the cyberattack lay in a vulnerability in obsolete software and, critically, the publicising of that vulnerability, will the cabinet secretary consider whether it would be appropriate to have a database that gives us knowledge of the use of obsolete software in public services and, therefore, enables us to target news of potential vulnerabilities of which we become aware at the appropriate people before potential attacks?

Shona Robison: Stewart Stevenson makes an important point. In response to Donald Cameron, I made the point that this is not about one type of software. The ransomware appears to have affected a number of different software and has particularly impacted on GP practices, rather than on acute hospitals, with NHS Lanarkshire being the exception.

We need to understand a bit more about what lies underneath the more vulnerable areas, because there appears to be a different pattern in different places—we need to understand all that more readily before we decide what action to take. The national cyberresilience leaders board, which is meeting today, chaired by my colleague, Michael Matheson, has the requisite experts and we will draw on further experts, so I can assure Stewart Stevenson that the recommendations that we take forward on how we make our systems more resilient will be based on the best available advice that we can find.