The past few months have been extremely challenging for the public sector in the UK. Not only is the country shattered by riots in multiple sectors and especially the medical one, but the NHS has also had to face a series of ransomware attacks.
While more parts of the public industry have been tackled, the truth is the NHS has taken it the worst. According to the NHS Trust, the most recent attack caused the biggest breach of healthcare data in the sector’s history.
Targeted by the ALPHV hacking group, Barts Health NHS Trust has lost more than 7 terabytes of private data covering all the hospitals in its portfolio, Mile End Hospital, Saint Bartholomew's Hospital, Newham Hospital, The Royal London Hospital, and Whipps Cross Hospital.
Private details from thousands of patients and staff members have been stolen by the hacking group in a quick operation that wasn’t detected quick enough to prevent the disaster.
The second hack in less than a month
This is by far the most aggressive hacking attack the NHS has been through, but it’s definitely not the first one. A series of attacks have targeted the national health system of the UK over the past months, with the most recent one taking place during June.
A ransomware attack has targeted the University of Manchester. Hackers gained access to a data package holding private information for more than 1.1 million patients and not just in Manchester, but also in the surroundings.
Patients from more than 200 hospitals were included in the respective dataset. Some of the data stolen included private NHS numbers of patients, as well as the first letters of their postcodes.
The university has released an official statement back then, more like a warning to health officials. However, according to this statement, it looks like the IT department has no idea how many of the NHS patients were actually affected by the data breach.
The data stolen from the NHS
After an initial investigation into the NHS, it looks like the stolen documents cover both employees and patients of the NHS. The same investigation has revealed that about 7 terabytes of data has been stolen, which could allegedly mean hundreds of thousands of people.
In terms of staff documents, the NHS holds private records regarding employees, such as identification documents like passport or driver licenses. As for patients, the list goes much further. Apart from IDs, the data may also include banking and card information, which could have serious consequences.
Furthermore, an internal investigation has revealed the fact that hackers have also gained access to numerous emails and messages labeled confidential.
Dark web leaks and threatening messages
The initial announcement from the ALPHV hacking group came at the end of June, and it's still uncertain whether the two parties have reached an agreement. However, based on previous similar cases, it looks like hackers almost never get the money they ask for.
The announcement was made by the ALPHV hacking gang, which gave the NHS not more than three days to decide what to do, whether to pay a ransom for the data or just let it go out on the dark web.
Days after the announcement, it’s not clear whether the hacking gang has already published or sold anything. Even if the private data has been released, it would be hard to determine where. The dark web is a comprehensive environment where users need to know specific links to get into them.
From a different point of view, the hacking gang may choose to sell the data, rather than release it for free. After all, it looks like they’d rather make money out of it. Again, if it’s out for sale already, it could be in any random marketplace on the dark web.
The way these attacks work is fairly simple to understand. When hackers manage to break into a system and steal private data, they try to obtain money from the respective institution or company in order to keep the data private. Otherwise, they release it.
In most cases, hackers tend to sell the respective data for insignificant amounts of money, only to make a profit out of it. The price is usually much lower than the initial ransom they ask in the beginning.
While the NHS has tried to keep the press out of it, the truth is such attacks often make it to the media. Hackers often make public announcements and sometimes even provide evidence in order to draw attention. Payments are usually requested in cryptocurrency for more privacy.
It’s not clear whether or not the NHS has paid anything to keep the data private. At the same time, there are no guarantees whatsoever that making a payment will actually convince hackers to delete the stolen data, so in most cases, such hacks become public and accessible by anyone.
Comments 0