London Hospitals Held To Ransom

Seven London NHS hospital trusts have been forced to cancel all non-emergency operations and blood tests following a major cyber attack. 

This has meant that operations are being cancelled and emergency patients being diverted elsewhere. It applies to hospitals partnered with Synnovis, a provider of pathology services to a least seven hospitals run by the NHS in the London area have been attacked.  

Synnovis covers Guy’s Hospital, which runs the Evelina London Children’s Hospital, as well as Harefield Hospital, King’s College Hospital, Princess Royal University Hospital, Royal Brompton Hospital and St Thomas’ Hospital as well as GP services across South London. The incident has had a "major impact" on the delivery of services, especially blood transfusions and test results. Non-hospital GP services across large parts of London  have also been affected. 

According to reports, the attack began on Monday 3rd June when a number of Hospital departments could not connect to a main server. As a consequence, some procedures have been cancelled or have been redirected to other NHS providers as the hospitals try to establish what work can be carried out safely.  However the NHS has said that emergency care continued to be available. 

NHS officials said they are working with the National Cyber Security Centre to understand the impact of the attack, while Synnovis said it has been reported to law enforcement and the Information Commissioner

A spokesperson for NHS England London said in a statement “On Monday 3 June Synnovis, a provider of lab services, was the victim of a ransomware cyber attack...  This is having a significant impact on the delivery of services at Guy’s and St Thomas’, King’s College Hospital NHS Foundation Trusts and primary care services in south east London and we apologise for the inconvenience this is causing to patients and their families." 

“We are working urgently to fully understand the impact of the incident with the support of the government’s National Cyber Security Centre and our Cyber Operations team.” A spokesperson from Synnovis said the company had sent in a "taskforce of IT experts" to "fully assess" the impact. 

In a new development, the group of cyber criminals known as Qilin are thought to be behind the  cyber attack. Qilin is understood to be a Russian hacking gang that runs a ransomware-as-a-service model. They operate using websites on the Dark Web and are suspected of previously targeting  the Big Issue publishing group.

According to the experts at Check Point, Qilin is a Russian-affiliated cyberattack group that operates on a ransomware-as-a-service (RaaS) model and has been active since 2022. This group is known for using Rust and Go programming languages to create its versatile ransomware and maintains a shame site to publish the identity and data stolen from its victims, conducting double-extortion tactics. The group, also known as ‘Agenda’, launched its operations in August 2022 and “rebranded” to Qilin in 2023.

According to Ciaran Martin, the former Chief Executive of the National Cyber Security Centre, Qilin has a two-year history of attacking organisations across the world. Martin claims Qilin’s attack on Synnovis is “more serious”  as it has led to systems not working, adding that this is “really one of the more serious that we’ve seen in this country”.  

In other comment, Alan Stephenson-Brown the CEO at Evolve Group describes the attack as ".. a stark reminder of the importance of stringent cybersecurity measures in the healthcare industry. The value of personal identifiable information held by the NHS cannot be underestimated, or how much of a target it makes the sector to actors who deal in such data on the dark web..."

"While it’s been reported that the health board in this case is urging the public to be alert for any attempts to access their work and personal data, I urge this action to start at the top, and for healthcare bosses to seriously appraise the systems they have in place to identify any potential vulnerabilities... While ensuring contingency planning is in place is vital, healthcare providers should urgently take preventative measures to protect patient data." he said.

Underinvestment in IT can leave systems vulnerable to attack, however, the risk to patient health means hospitals are motivated to restore services as quickly as possible, regardless of the cost. 

While British government policy is not to pay hackers, healthcare services are a priority targets internationally for ransomware gangs, as demonstrated in other recent attacks on the Britsh NHS as well as national healthcare services in Ireland and Spain

NHS England   |   BBC   |   Independent   |   Guardian   |   Computer Weekly   |   The Record   |   News&Star    |

Check Point Software

Image: Ideogram

You Might Also Read:

Stolen NHS Data Published On The Dark Web:

___________________________________________________________________________________________

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« You’ve Got Mail
Hackers Target Healthcare »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Cura Software Solutions

Cura Software Solutions

Cura Software Solutions (formerly Cura Technologies) is a market-leader in Governance, Risk and Compliance (GRC) enterprise applications.

Fastpath Solutions

Fastpath Solutions

Fastpath deliver software solutions that enable you to take control of your security, compliance and risk management initiatives.

Nation-E

Nation-E

Nation-E offers innovative cyber security solutions for industrial installations, critical infrastructure and smart grids.

VADO Security Technologies

VADO Security Technologies

VADO Security enables the safe transfer of data between low & high security networks.

Cybersecurity Collaborative

Cybersecurity Collaborative

CyberSecurity Collaborative is a forum for CISOs to share information that will collectively make us stronger, and better equipped to protect our enterprises from those seeking to damage them.

IoTsploit

IoTsploit

IoTsploit provides 20/20 visibility of network connections, protecting critical infrastructure assets from IoT vulnerabilities.

International Accreditation Forum (IAF)

International Accreditation Forum (IAF)

The IAF is the world association of Conformity Assessment Accreditation Bodies. Its primary function is to develop a single worldwide programme of conformity assessment.

CyberDegrees.org

CyberDegrees.org

CyberDegrees.org aims to provide top-notch information for students seeking Cyber Security education and career guidance.

CNA Insurance

CNA Insurance

CNA offers a market-leading suite of cyber liability insurance products and risk control resources for businesses of all sizes.

Asia Data Destruction (ADD)

Asia Data Destruction (ADD)

ADD is the leading IT Assets Disposal and Data Destruction Company in Thailand.

Raqmiyat

Raqmiyat

Raqmiyat provides end-to-end IT Services and business solutions including consultancy, digital transformation, infrastructure and cybersecurity.

C3i Hub

C3i Hub

C3i Hub aims to address the issue of cyber security of cyber physical systems in its entirety, from analysing security vulnerabilities to developing tools and technologies.

UnderDefense

UnderDefense

UnderDefense provides cyber resiliency consulting and technology-enabled services to anticipate, manage and defend against cyber threats.

Single Point of Contact

Single Point of Contact

Single Point of Contact is a Managed IT Services provider that helps businesses to achieve a seamless and secure IT environment.

CXI Solutions

CXI Solutions

CXI Solutions: Your trusted partner in cybersecurity. We offer a full range of cybersecurity solutions to protect your business from digital attacks and virtual threats.

RST Cloud

RST Cloud

RST Cloud is a cutting-edge technology company that specialises in threat intelligence solutions for businesses of all sizes.