Fears For NHS Patient Data After Cyber-Attack

NHS supplier cyber-attack raises fears for patient data

- Dan Milmo and Denis Campbell

Patient data could have been stolen in a cyber-attack on an NHS software supplier, experts have warned, as an internal memo reveals the incident has badly disrupted the functioning of several key health services. Areas affected include the 111 telephone advice service, GP surgeries and some specialist mental health trusts.

The National Cyber Security Centre (NCSC) and other government agencies are trying to discover the scale of the damage caused by the incursion, amid fears that sensitive medical information may have been taken during the process.

Advanced, which provides services for NHS 111 and patient records, confirmed late on Wednesday it had been hit by ransomware during last week’s attack. The British company said it was investigating “potentially impacted data” and that it would provide updates when it had more information about “potential data access or exfiltration”.

The NCSC, which is part of GCHQ, said it was “working with the company to fully understand the impact, while supporting the NHS”. The attack affected 111 services across the UK. The Information Commissioner’s Office, the data watchdog, confirmed it was aware of the incident, which took place on Thursday 4 August, and was “making inquiries”.

A leaked internal NHS England document, seen by the Guardian, has disclosed that “a number of NHS services, including NHS 111, some urgent treatment centres and some mental health providers, use software that have been taken offline”.