I'm not surprised this is costing a fortune. Money was cut from most of the public sector and basic maintenance was an easy thing to stop. Since they'd never had a problem there was not problem. Patching just causes downtime doesn't it?
It'll have left them with a massive pile of catch-up actions and no staff to do it since they'd all been paid off
I wonder if the NHS be getting ongoing money to do maintenance on an ongoing basis or if we'll be back here in 5yr since they'll patch all the wannacry stuff then stop thinking the job is done?