London Hospitals Held To Ransom

Seven London NHS hospital trusts have been forced to cancel all non-emergency operations and blood tests following a major cyber attack. 

This has meant that operations are being cancelled and emergency patients being diverted elsewhere. It applies to hospitals partnered with Synnovis, a provider of pathology services to a least seven hospitals run by the NHS in the London area have been attacked.  

Synnovis covers Guy’s Hospital, which runs the Evelina London Children’s Hospital, as well as Harefield Hospital, King’s College Hospital, Princess Royal University Hospital, Royal Brompton Hospital and St Thomas’ Hospital as well as GP services across South London. The incident has had a "major impact" on the delivery of services, especially blood transfusions and test results. Non-hospital GP services across large parts of London  have also been affected. 

According to reports, the attack began on Monday 3rd June when a number of Hospital departments could not connect to a main server. As a consequence, some procedures have been cancelled or have been redirected to other NHS providers as the hospitals try to establish what work can be carried out safely.  However the NHS has said that emergency care continued to be available. 

NHS officials said they are working with the National Cyber Security Centre to understand the impact of the attack, while Synnovis said it has been reported to law enforcement and the Information Commissioner

A spokesperson for NHS England London said in a statement “On Monday 3 June Synnovis, a provider of lab services, was the victim of a ransomware cyber attack...  This is having a significant impact on the delivery of services at Guy’s and St Thomas’, King’s College Hospital NHS Foundation Trusts and primary care services in south east London and we apologise for the inconvenience this is causing to patients and their families." 

“We are working urgently to fully understand the impact of the incident with the support of the government’s National Cyber Security Centre and our Cyber Operations team.” A spokesperson from Synnovis said the company had sent in a "taskforce of IT experts" to "fully assess" the impact. 

In a new development, the group of cyber criminals known as Qilin are thought to be behind the  cyber attack. Qilin is understood to be a Russian hacking gang that runs a ransomware-as-a-service model. They operate using websites on the Dark Web and are suspected of previously targeting  the Big Issue publishing group.

According to the experts at Check Point, Qilin is a Russian-affiliated cyberattack group that operates on a ransomware-as-a-service (RaaS) model and has been active since 2022. This group is known for using Rust and Go programming languages to create its versatile ransomware and maintains a shame site to publish the identity and data stolen from its victims, conducting double-extortion tactics. The group, also known as ‘Agenda’, launched its operations in August 2022 and “rebranded” to Qilin in 2023.

According to Ciaran Martin, the former Chief Executive of the National Cyber Security Centre, Qilin has a two-year history of attacking organisations across the world. Martin claims Qilin’s attack on Synnovis is “more serious”  as it has led to systems not working, adding that this is “really one of the more serious that we’ve seen in this country”.  

In other comment, Alan Stephenson-Brown the CEO at Evolve Group describes the attack as ".. a stark reminder of the importance of stringent cybersecurity measures in the healthcare industry. The value of personal identifiable information held by the NHS cannot be underestimated, or how much of a target it makes the sector to actors who deal in such data on the dark web..."

"While it’s been reported that the health board in this case is urging the public to be alert for any attempts to access their work and personal data, I urge this action to start at the top, and for healthcare bosses to seriously appraise the systems they have in place to identify any potential vulnerabilities... While ensuring contingency planning is in place is vital, healthcare providers should urgently take preventative measures to protect patient data." he said.

Underinvestment in IT can leave systems vulnerable to attack, however, the risk to patient health means hospitals are motivated to restore services as quickly as possible, regardless of the cost. 

While British government policy is not to pay hackers, healthcare services are a priority targets internationally for ransomware gangs, as demonstrated in other recent attacks on the Britsh NHS as well as national healthcare services in Ireland and Spain

NHS England   |   BBC   |   Independent   |   Guardian   |   Computer Weekly   |   The Record   |   News&Star    |

Check Point Software

Image: Ideogram

You Might Also Read:

Stolen NHS Data Published On The Dark Web:

___________________________________________________________________________________________

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« You’ve Got Mail
Hackers Target Healthcare »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

InfoSec People

InfoSec People

InfoSec People is a boutique cyber and technology recruitment consultancy, built by genuine experts.

Intruder

Intruder

Intruder is a cloud-based vulnerability scanner that finds cyber security weaknesses in your digital infrastructure, to avoid costly data breaches.

DataSunrise

DataSunrise

DataSunrise Data-Centric high-performance security software protects the sensitive data in real-time in cloud or on premises, and helps organizations to stay compliant.

Computing Technology Industry Association (CompTIA)

Computing Technology Industry Association (CompTIA)

CompTIA is dedicated to advancing industry growth through its educational programs, market research, networking events, professional certifications, and public policy advocacy.

Living Security

Living Security

Living Security specializes in metric driven and engaging security awareness solutions that reduce risk by increasing security culture and changing employee behaviour.

Shift Technology

Shift Technology

Shift Technology provides insurance companies with an innovative SaaS solution to improve and scale fraud detection.

Computer Forensics Consult (CFC)

Computer Forensics Consult (CFC)

Computer Forensics Consult provides disaster recovery, computer forensics, electronic discovery and litigation support services in the growing area of Cyber Security.

SevenShift

SevenShift

SevenShift is a security consulting firm with a wealth of experience in the worlds of Cybersecurity and Internet of Things (IoT).

Indeed

Indeed

Indeed is a worldwide employment-related search engine for job listings covering job types in all industries, including cybersecurity.

Capsule8

Capsule8

Capsule8 is the only company providing high-performance attack protection for Linux production environments.

CSC Digital Brand Services

CSC Digital Brand Services

Our brand protection and security expertise give our customers peace of mind that no matter how fast the digital world changes, their intellectual property and digital assets will be secure.

Quantinuum

Quantinuum

Quantinuum is the combination of Cambridge Quantum with Honeywell Quantum Solutions, structured to drive the future of quantum computing.

Communicate Technology

Communicate Technology

Communicate Technology are IT, telecoms and cyber-security specialists, keeping over 500 businesses and 50,000 users connected and secure across the UK.

Intigriti

Intigriti

Intigriti helps companies protect themselves from cybercrime. Our community of ethical hackers provides continuous, realistic security testing to protect our customer’s assets and brand.

Aembit

Aembit

Aembit is the Identity Platform that lets DevOps and Security manage, enforce, and audit access between federated workloads

Arakyta

Arakyta

Arakÿta specializes in business strategy, work flow process and IT systems for organizations.