NHS patient data compromised in university cyber attack – report
- 30 June 2023
NHS details of more than one million patients have been compromised in a recent ransomware attack on the University of Manchester, according to The Independent.
Following a widely published cyber attack earlier this month at the University of Manchester, it has now been suggested that NHS data could also have been accessed maliciously.
The University of Manchester holds information on 1.1 million patients from 200 hospitals, after the information was gathered by the university for research purposes. It is likely that some of the patients involved in the breach will be unaware they were even on the database – as they did not need to give specific consent to be included on it.
An NHS document, which was seen by The Independent, confirmed specialist analysis had shown the University of Manchester’s back-up servers were accessed. It does not yet know whether the patients’ names have been hacked, or how many patients are affected by the breach. Initial investigations suggest around 250 gigabytes of data was accessed.
Originally launched in 2012, the data set has since been closed; however, the university has warned that there is “potential for NHS data to be made available in the public domain”.
The details that could potentially be exposed include NHS numbers and the first three letters of patients’ postcodes.
Earlier breach
On the 6th of June, some of the institution’s systems were accessed by an unauthorised user. The university confirmed a “small proportion of data” related to some students and alumni were thought to have been accessed in the attack and copied by hackers.
An email was then sent to students and staff at the university threatening to sell their personal data on the black market, if the university failed to resolve the situation and meet their demands.
A cyber incident update posted to the University Of Manchester’s website on the 23 June, stated:
“… we would like to assure our community that our internal and external experts are working around the clock to continue to address this and our investigations are continuing.
“We are continuing to work with the relevant authorities, including the Information Commissioner’s Office, the National Cyber Security Centre (NCSC), the National Crime Agency and other regulatory bodies. Our cyber incident information page will also continue to be updated, as the first point of call for any ongoing updates.”
The university has so far not made any comment on the recent news that NHS data was affected by the breach earlier this month.
The news comes just weeks after Health Service Ireland (HSE) became the latest victim of the MOVEit supply chain cyber attack.
According to SonicWall, there has been an 8% increase in ransomware attempts in the global healthcare sector, with over 11 million between 2022-2023.
