Ransomware group releases NHS Dumfries and Galloway patient data

NHS Dumfries and Galloway have confirmed today that data relating to a small number of patients has been released by a recognised ransomware group, following the cyber attack on its IT systems on 15 March.

In a statement released today (27 March), NHS Dumfries and Galloway said: “NHS Dumfries and Galloway is aware that clinical data relating to a small number of patients has been published by a recognised ransomware group.

“This follows a recent focused cyber attack on the Board’s IT systems, when hackers were able to access a significant amount of data including patient and staff-identifiable information.”

According to The Guardian, reports emerged of a post by the group Inc Ransom on its darknet blog, alleging it was in possession of three terabytes of data from NHS Scotland. The post includes a “proof pack” of some of the data, which has now been confirmed by the board to be genuine.

The “proof pack”, the UK Defence Journal says, includes a variety of sensitive documents, ranging from biochemistry and genetics reports to letters between doctors discussing patient treatments and psychological reports.

These documents also said to contain highly personal medical details, includes names and addresses of patients. The attack was publicly disclosed on 26 March by Inc Ransom, however no deadline for a ransom payment has yet been provided.

NHS Dumfries and Galloway chief executive Jeff Ace said: “We absolutely deplore the release of confidential patient data as part of this criminal act. This information has been released by hackers to evidence that this is in their possession.

“We are continuing to work with Police Scotland, the National Cyber Security Centre, the Scottish Government, and other agencies in response to this developing situation. Patient-facing services continue to function effectively as normal.

“As part of this response, we will be making contact with any patients whose data has been leaked at this point and continue working to limit any sharing of this information.

“NHS Dumfries and Galloway is very acutely aware of the potential impact of this development on the patients whose data has been published, and the general anxiety which might result within our patient population.”

The board suffered a cyber attack on Friday 15 March and said at the time that “there is a risk that hackers have been able to acquire a significant quantity of data”, something that has now been proven to be true.