Two NHS trusts affected by cyber attack on mobile phone software

NHS England is investigating a cyber incident at University College London Hospitals NHS Foundation Trust (UCLH) and University Hospital Southampton NHS Foundation Trust.

A spokesperson for UCLH told Digital Health News that a software product used at the trust to manage UCLH mobile phones and tablets was” briefly compromised” earlier in May 2025.

“The product, which did not contain patient data or staff passwords, was made secure swiftly.

“The product did contain some staff mobile and IMEI numbers and we are contacting those staff affected.

“We want to reassure patients and staff that we are committed to protecting their data and privacy and we are investigating this matter thoroughly with NHS England’s cyber security response team,” the spokesperson added.

Sky News reported that data was taken after hackers exploited holes in the Ivanti Endpoint Manager Mobile (EPMM) software, a programme that helps businesses manage employee phones.

Analysts at intelligence threat platform EclecticIQ told Sky News the software’s vulnerability had allowed hackers to access, explore and run programmes on their target’s systems using an IP address based in China.

Although the hole in Ivanti’s software has been fixed, EclectricIQ warned that the attack could leave hackers able to access other data like patient records and further parts of the network via a process called remote code execution (RCE) – running programmes on compromised systems.

A statement on Ivanti’s website, published on 22 May 2025, said: “Ivanti has released updates for Endpoint Manager Mobile (EPMM) which addresses one medium and one high severity vulnerability.

“When chained together, successful exploitation could lead to unauthenticated remote code execution.

“We are aware of a very limited number of customers whose solution has been exploited at the time of disclosure.”

A spokesperson for NHS England told Digital Health News that there is “currently no evidence to suggest patient data has been accessed”, adding that “health services are not currently affected”.

“We are currently investigating this potential incident with cyber security partners, including the National Cyber Security Centre, and the trusts mentioned.

“NHS England provides 24/7 cyber monitoring and incident response across the NHS, and we have a high severity alert system that enables trusts to prioritise the most critical vulnerabilities and remediate them as soon as possible,” the spokesperson said.

A spokesperson for the National Cyber Security Centre said that they are working to fully understand the UK impact following reports that critical vulnerabilities in the Ivanti software have been exploited.

“The NCSC strongly encourages organisations to follow vendor best practice to mitigate vulnerabilities and potential malicious activity.

“Vulnerabilities are a common aspect of cyber security, and all organisations must consider how to most effectively manage potential security issues,” they added.

Commenting on the attack, Graeme Stewart, head of public sector at Check Point Software, said: “This wasn’t a one-off. It’s part of a growing pattern in which critical sectors, such as healthcare, are being quietly compromised through third-party software.”

Meanwhile, in May 2025, suppliers to the NHS were urged by NHSE to sign a charter of cyber security best practice.