Hackers threaten to release huge amount of NHS Scotland data

EXCLUSIVE – A ransomware group has threatened to release an astonishing three terabytes of stolen NHS patient and staff data, which it says will be published “soon” if their demands are not met.

The cybercriminals have gone as far as posting several letters and medical reports as evidence of their successful breach.

The disclosed “proof pack”, which we have blurred below, includes a variety of sensitive documents, ranging from biochemistry and genetics reports to letters between doctors discussing patient treatments and psychological reports. Alarmingly, these documents contain highly personal medical details, including names and addresses of patients.

The attack was publicly disclosed by INC RANSOM on March 26, but no specific deadline for a ransom payment has been provided. We have contacted NHS Scotland for comment.

Interestingly, the ransomware gang’s claims have been somewhat corroborated by NHS Dumfries and Galloway, a regional health board under NHS Scotland. On March 15, they reported a cyber incident, acknowledging the potential compromise of a significant amount of data.

Offering an update, NHS Dumfries and Galloway Chief Executive Jeff Ace said:

“As you would expect, this has been viewed as an extremely serious matter demanding a major response. Over recent days we’ve been very busy working with partner agencies to ensure the security of our systems, to adapt to the associated disruption, and to assess the potential risk posed by the hackers’ ability to access data.

It must be noted that this is a live criminal investigation, and we are very limited in what we can say. In addition, a great deal of work is required in order to say with assurance what data may have been obtained, and we are not yet in that position. However, as it has been noted, there is reason to believe that those responsible may have acquired patient and staff-specific data. The NHS Board views patient and staff confidentiality as a key priority, along with ensuring welfare and wellbeing. As such, very great effort is being made to address this situation, and to try to prevent it from being repeated.

We will look to update as and when we can, but in the meantime would again caution staff and patients to be on their guard for anyone accessing their systems, or anyone making contact with them claiming to be in possession of any information. Any such incidents should be reported immediately to Police Scotland on 101.”

Many of the documents flaunted by INC RANSOM seem to originate from this particular region, adding credibility to the ransomware gang’s assertions, we’ll update you when we have more from NHS Scotland on this.

INC Ransom first appeared in July 2023, and it not only encrypts and steals its target’s data but then threatens to publish it online if the victim doesn’t pay. According to Ransomlooker, Cybernews’ ransomware monitoring tool, INC Ransom has taken aim at least 65 organisations over the last 12 month period.

A Police Scotland spokesperson told me: “Enquiries are ongoing.”

Update as of 1220pm.

NHS Dumfries and Galloway have said that it is aware that clinical data relating to a small number of patients has been published by a recognised ransomware group. This follows a recent focused cyber attack on the Board’s IT systems, when hackers were able to access a significant amount of data including patient and staff-identifiable information.

NHS Dumfries and Galloway Chief Executive Jeff Ace said:

“We absolutely deplore the release of confidential patient data as part of this criminal act. This information has been released by hackers to evidence that this is in their possession.

We are continuing to work with Police Scotland, the National Cyber Security Centre, the Scottish Government and other agencies in response to this developing situation. Patient-facing services continue to function effectively as normal.

As part of this response, we will be making contact with any patients whose data has been leaked at this point.

NHS Dumfries and Galloway is very acutely aware of the potential impact of this development on the patients whose data has been published, and the general anxiety which might result within our patient population.”