Cyber Attack On NHS Software Services

British NHS 111 medical staff nationwide were left using pens and paper after a major cyber attack was carried out over the weekend. People seeking medical help via the service are being warned of delays due to a “major” computer system outage caused by the attack which affected the phone service and referrals to out-of-hours GPs.

The system was shut down by hackers thought to be linked to a hostile state and cyber crime experts have been drafted in to investigate.

Advanced, a firm providing digital services for NHS 111, said the attack was spotted at 07:00 on Thursday 4th August. The attack targeted the system used to refer patients for care, including ambulances being dispatched, out-of-hour appointment bookings and emergency prescriptions.

The British National Crime Agency said it was "aware of a cyber incident" and was working with Advanced. "A security issue was identified yesterday, which resulted in a loss of service. We can confirm that the incident is related to a cyber attack and as a precaution, we immediately isolated all our health and care environments. Early intervention from our Incident Response Team contained this issue to a small number of servers representing 2% of our Health & Care infrastructure." an Advanced spokesman said

Advanced suggested the issue might not be fully resolved until next week and family doctors in London were warned by NHS England they could see an increased number of patients sent to them by NHS 111 due to the severe technical issue. It said a letter to GPs in the capital stated the problem was affecting the electronic referral process for patients.

Officials believe the fallout will last until Tuesday at the earliest, with the public told there will be delays when ringing the hotline.

It’s feared disruption could drive patients to overstretched accident and emergency departments over the weekend. An NHS England spokesperson said there was currently minimal disruption, and it was monitoring the situation. "NHS 111 services are still available for patients who are unwell, but if it is an emergency please call 999," they said.  

  • The Isle of Wight NHS Trust declared a critical incident in response to ‘sustained pressure’ on its A&E services. 
  • The Welsh Ambulance Service warned it may take longer for calls to be answered over the weekend. It said: "There is a major outage of a computer system that is used to refer patients from NHS 111 Wales to out-of-hours GP providers.
  • A Scottish Government spokesperson said it was aware of reported disruption to one of NHS Scotland's IT suppliers' systems and is "working with all health boards collaboratively on a four nations basis with the National Cyber Security Centre and the supplier to fully understand potential impact".
  • A spokesperson for Northern Ireland's Department of Health said they are working to keep disruption to a minimum. "As a precaution, to avoid risk to other critical systems and services, access to the company's services from the HSC (Health and Social Care system) has been disabled, while the incident is contained," they said.

Commenting on the attack Ross Brewer of enterprise cyber security platform AttackIQ said, ‘’This latest breach bringing the NHS 111 service to its knees is yet another example of an IT supplier being used to gain access in order to bring down critical national infrastructure...  While the specific details in this case are still developing, typically compromises of suppliers are used as an entry point to gain access to the target organisation or the service a supplier may be running on their behalf."

Regardless of the entry point, organisations should have protection and detection mechanisms to stop such intrusions developing into a catastrophic service failure, according to Brewer.

"In the case of cloud services hosted by the third party suppliers, the provider should have similar protections. To often not enough testing of people, processes and technology is taking place to validate an organisation’s cyber security readiness." he added.

An NHS spokesperson said “There is currently minimal disruption, and the NHS will continue to monitor the situation as it works with Advanced to resolve their software system as quickly as possible, tried and tested contingency plans are in place for local areas who use this service.”    

 Pulse Today:     HSToday:     BBC:    Guardian:     Independent:     Metro:   STV:     LBC: 

You Might Also Read: 

Ireland’s Health Service Won't Pay Ransom:
 

« AI Driven Anomaly Detection In The Oil & Gas Industry
Taiwan's Government Websites Attacked Just Before Pelosi’s Visit »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Renaissance

Renaissance

Renaissance is Ireland's premier value added distributor of IT security solutions and a leading independent provider of business continuity consultancy.

Axial

Axial

Axial Systems is one of the UK’s leading solution providers and systems integrators in network, security and services.

Vintegris

Vintegris

Vintegris are a Certification Authority and manufacturer of innovative systems and applications for the full cycle of digital identity.

Inseego

Inseego

Inseego provides Enterprise SaaS solutions and IoT & Mobile solutions, which together form the backbone of intelligent, reliable and secure IoT services with deep business intelligence.

Crashtest Security

Crashtest Security

Crashtest Security is a cyber security company that helps digital companies to continuously create secure software with the help of automated vulnerability assessments.

Euro-Recycling

Euro-Recycling

Euro-Recycling is a leading UK provider of Secure On-Site Data Media Destruction Services.

6point6

6point6

6point6 is a technology consultancy with strong expertise in digital transformation, emerging technology and cyber security.

Nineteen Group

Nineteen Group

Nineteen Group delivers major-scale exhibitions within the security, fire, emergency services, health and safety, facilities management and maintenance engineering sectors.

Cybolt

Cybolt

Cybolt helps companies, organizations, and governments manage digital risks and live in an environment of confidence and certainty.

Cyber Resilience Centre for Wales (WCRC)

Cyber Resilience Centre for Wales (WCRC)

The Cyber Resilience Centre for Wales (WCRC) is part of the national roll out of Cyber Resilience Centres in the UK which began in 2019.

Quantropi

Quantropi

Quantropi is bound to be the standard for quantum-secure data communications – forever unbreakable, no matter what.

Mission Critical Partners (MCP)

Mission Critical Partners (MCP)

Mission Critical Partners is committed to delivering innovative solutions that help our clients enhance and evolve their critical-communications systems and operations.

Pathlock

Pathlock

Pathlock (formerly Greenlight) help enterprises and organizations automate the enforcement of any process, access, or IT general control, for any business application.

Persona

Persona

At Persona, we’re humanizing online identity by helping companies verify that their users are who they say they are.

Cyber Law Consulting

Cyber Law Consulting

Cyber Law Consulting is a Dynamic full service legal firm which offers complete services for Cyber Law, cyberlaw, Internet Law, Data Protection Act, Cyber Security, IPR, Drafting.

Sekur Private Data

Sekur Private Data

Sekur Private Data Ltd. is a Cybersecurity and Internet privacy provider of Swiss hosted solutions for secure communications and secure data management.