NHS increasingly targeted by blackmailing hackers

New reports have suggested that current IT systems used by the NHS are increasingly vulnerable to attacks by hackers attempting to extort ransoms from hospitals.

A Freedom of Information request by the i newspaper has revealed that at least 28 NHS trusts in England have been victim to ransomware incursions in the last 12 months - with up to four incidents considered to be sufficiently serious that they had to be reported as a potential breach of data protection or confidentiality laws.

NHS Digital has conceded that there has been an increase in attacks but said that no ransom was paid and no data was lost, with patient records unaffected.

The rising threat of ransomware was recently highlighted by Europol, the EU’s law enforcement body, as the ‘dominant threat’ to public and private organisations across Europe as organised crime groups deploy an increasingly sophisticated arsenal of viruses.

Ransomware works by implanting a piece of software, often sent disguised in an email, which then turns data on a machine or network into encrypted gobbledygook. The senders then demand a ransom, paid in an untraceable cyber currency such as BitCoin, which averages £350 to £700 but can reach into thousands. According to one estimate, the extortion racket is worth some £300m a year.

Ollie Whitehouse, technical director of NCC Group, the company that obtained the data, told the i: "Ransomware has become the bottom line of cyber crime - if hackers break into a system and can't find any other way to monetise what they find, they encrypt the data and demand a ransom.

"We have seen a 400 per cent increase in these attacks. The health service is by no means alone in facing this kind of attack. But NHS trusts are being increasingly targeted and any loss of patient data would be a nightmare scenario. Like everyone else, they need to be applying robust controls."