Investigation into Russian Ransomware Attack on London Hospitals Could Take Weeks, Data Dump Raises ConcernsInvestigation into Russian Ransomware Attack on London Hospitals Could Take Weeks, Data Dump Raises Concerns The National Health Service (NHS) in the United Kingdom is investigating a ransomware attack on London hospitals by the Russian group Qilin earlier this month. The investigation could take weeks to complete, and concerns have arisen over a reported data dump of patient records online. Over two weeks after the June 3 attack on Synnovis, a pathology service provider in south-east London, hundreds of operations and appointments remain canceled. The attack impacted hospital trusts such as King’s College, Guy’s and St Thomas’, among others. The NHS reported a “major impact” on services, particularly blood transfusions. NHS England acknowledged that data related to the attack has been published online, raising concerns about patient privacy. According to the BBC, Qilin shared nearly 400 GB of data, including patient names, birthdates, and blood test descriptions. The National Crime Agency and the National Cyber Security Center are verifying the data’s authenticity. The investigation is complex, and it could take several weeks or longer to complete. The Guardian newspaper reported that during the attack, data on approximately 300 million patient interactions, including blood test results for HIV and cancer, was compromised. The NHS has established a website and helpline for affected patients. “We understand the distress this will cause to patients who need to be retested,” NHS England stated. Ransomware attacks involve criminals encrypting computer systems and demanding money to unlock them. It is the most costly and disruptive form of cybercrime, affecting governments, hospitals, and businesses. Qilin, also known as Agenda, advertises on cybercrime forums and rents malware to affiliates who carry out attacks for a share of the ransom. The British healthcare system has faced previous ransomware attacks, including a 2017 incident that disrupted hospital operations nationwide.
An investigation into a ransomware attack earlier this month on London hospitals by Russian group Qilin could take weeks, with some patients requiring repeat tests
By means of
PAN PYLAS Associated Press
June 22, 2024, 7:20 AM ET
3 minutes reading
LONDON — An investigation into a ransomware attack earlier this month on London hospitals by Russian group Qilin could take weeks, the country’s state-run National Health Service said Friday, as concerns grow over a reported data dump of patient records.
Hundreds of operations and appointments continue to be canceled more than two weeks after the June 3 attack on NHS provider Synnovis, which provides pathology services mainly in south-east London.
The attack affected King’s College and Guy’s and St Thomas’ hospital trusts, which run several south London hospitals, as well as clinics and doctors’ practices in part of the city. A memo to staff called it a “critical incident” and said it had a “major impact” on services, particularly blood transfusions.
NHS England said on Friday it has been “made aware” that data relating to the attack has been published online. According to the BBC, Qilin shared nearly 400 GB of data, including patient names, dates of birth and descriptions of blood tests, on their darknet site and Telegram channel.
“The National Crime Agency and the National Cyber Security Center are working to verify the data contained in the published files as quickly as possible,” NHS England said in a statement. “These files are not simple uploads and therefore these types of investigations are very complex. and it could take weeks, if not longer, to complete.”
According to Saturday’s edition of The Guardian newspaper, data on 300 million patient interactions was stolen during the attack, including blood test results for HIV and cancer.
A website and helpline has been set up for affected patients.
“We understand the distress this will cause to patients who need to be retested,” NHS England said.
The National Crime Agency has confirmed it is leading the criminal investigation but cannot comment further.
Ransomware involves criminals crippling computer systems with malware and then demanding money to release them. Ransomware is the most expensive and disruptive form of cybercrime, affecting local governments, legal systems, hospitals, schools and businesses. It is difficult to combat because most gangs are based in former Soviet states and beyond the reach of Western justice.
Britain’s state-funded healthcare system has been hit before, including a 2017 ransomware attack that froze computers in hospitals across the country, shuttered wards, shuttered emergency departments and halted treatment.
Qilin, also known as Agenda, advertises on cybercrime forums on the dark web and rents malware to affiliates who use it to carry out attacks for a percentage of the ransom, says Louise Ferrett of Searchlight Cyber, a threat intelligence firm. The group has listed more than 100 victims.
