Irish health cyber-attack could have been even worse, report says