Source: www.govinfosecurity.com – Author:
Fraud Management & Cybercrime , Healthcare , HIPAA/HITECH
Inc Ransom is Leaking Stolen Data in At Least 2 Attacks, Including Pediatric Info Marianne Kolbasuk McGee (HealthInfoSec) • December 2, 2024
At least three National Health Service hospitals in the United Kingdom are responding to recent cyber incidents, including a children’s hospital and a heart and chest specialty hospital in Liverpool that share IT systems.
See Also: Advancing Cyber Resiliency With Proactive Data Risk Reduction
Russian-speaking ransomware group Inc Ransom on Thursday began leaking on its dark web site data allegedly stolen in the attack on the IT systems shared by Adler Hey Children’s NHS Foundation Trust and Liverpool Heart and Chest Hospital NHS Foundation Trust.
In addition to those two hospitals, a third NHS hospital – Wirral University Teaching Hospital – is dealing with an apparent separate cybersecurity incident that is affecting its IT systems and some patient services.
Adler Hey and Liverpool Heart and Chest hospitals said in statements that their services are “operating as normal” and that their data breaches are “not linked to the ongoing incident at Wirral University Teaching Hospitals.”
“We are aware that data has been published online and shared via social media that purports to have been obtained illegally from systems shared by Alder Hey and Liverpool Heart and Chest Hospital NHS Foundation Trust,” Adler Hey and Liverpool Heart and Chest said in statements posted on their websites.
“We are working with partners to verify the data that has been published and to understand the potential impact. We are taking this issue very seriously and are working with the National Crime Agency as well as partner organizations to secure our systems and to take further steps in line with law enforcement advice as well as our statutory duties relating to patient data,” the statements said.
Wirral University Teaching Hospital, an acute care hospital that operates the only emergency department in Wirral – a peninsula in northwest England – also on Thursday issued a statement that it was still dealing with a “major” targeted cyber incident declared earlier last week.
“After detecting suspicious activity, as a precaution, we isolated our systems to ensure that the problem did not spread. This resulted in some IT systems being offline,” Wirral hospital said. “We have reverted to our business continuity processes and are using paper rather than digital in the areas affected. We are working closely with the national cybersecurity services, and we are planning to return to normal services at the earliest opportunity,” the hospital said.
While patient care continues to be available, the incident has disrupted planned services including some scheduled appointments. “Unfortunately we have had to postpone some procedures, which will be rescheduled. The public are advised to continue to attend any scheduled appointments, along with their appointment letters, unless contacted otherwise.”
The hospital is continuing to prioritize emergency treatment “but there are likely to be longer-than-usual waiting times for unplanned treatment in our emergency department and assessment areas. We urge all members of the public to attend the emergency department only for genuine emergencies.”
Wirral University Teaching Hospital did not immediately respond to Information Security Media Group’s request for additional details about the ongoing incident, including whether a cybercriminal group has demanded a ransom.
As for data theft incidents affecting Adler Hey and Liverpool Heart and Chest hospitals, Inc Ransom in recent months also claimed credit for several other high-profile attacks in the healthcare sector including an attack in August on Arizona hospice pharmacy services provider OnePoint Patient Care.
OnePoint last week filed an updated breach report to Maine state regulators saying the incident affected more than 1.7 million people, double the original estimate in October of about 800,000.
Inc Ransom in August also claimed credit for a ransomware and data theft attack on Michigan-based McLaren Health Care. As of Monday, the recent McLaren incident had not yet been listed on the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals (see: McLaren Health Hit with Ransomware for Second Time in Year).
Meanwhile, the cyber incidents at the three NHS hospitals last week are just the latest attacks on U.K. healthcare organizations this year.
A June attack purportedly by ransomware-as-a-service group Qilin on Synnovis, a pathology laboratory services provider, not only affected patient care at several London hospitals for many weeks, but also triggered a national blood supply shortage in the U.K, forcing cancellation of thousands of medical procedures (see: NHS: Most Patient Services Online Following Synnovis Attack).
Original Post URL: https://www.govinfosecurity.com/cyber-incidents-hit-3-nhs-hospitals-in-uk-a-26949
Category & Tags: –
Views: 2
