The UK government is contemplating retaliatory measures against Russian hackers following the theft of 300 million patient records from the NHS. The National Crime Agency (NCA) is considering action against the Qilin ransomware gang, which recently released a vast amount of sensitive NHS data after a cyber-attack on June 3. This data includes results of blood tests for HIV and cancer, and the theft has significantly disrupted services at hospitals and GP practices in south-east London.

 

The National Crime Agency (NCA) and the National Cyber Security Centre (NCSC) are collaborating to explore options for mitigating the damage, including potentially removing the stolen data from public access. However, efforts to reclaim or take down the data may be complicated if the Qilin gang has made copies and is able to repost the information elsewhere.

 

The attack has heavily impacted King's College Hospital and Guy's and St Thomas' Hospital Trusts, resulting in the cancellation of over 1,100 planned operations and the postponement of more than 2,100 outpatient appointments. The hospitals and GP practices affected are still operating at reduced capacity for blood tests due to being locked out of their own IT systems by the hackers.

 

The government's consideration of retaliatory measures follows a precedent set earlier this year when the NCA, in cooperation with international partners, disrupted the LockBit ransomware group's operations. The NCA seized LockBit's "command and control" apparatus and infrastructure, marking a significant success in combating ransomware gangs operating from Russia or former Soviet states.

 

The theft and subsequent publication of NHS data have raised significant concerns about patient privacy and potential further criminal exploitation. NHS England has set up an incident helpline to assist anxious patients and has advised vigilance against any suspicious communications claiming to have their data. The NCA and NCSC are working to verify the extent of the data published by Qilin, a process that is expected to take weeks due to the complexity of the files.

 

Additionally, the stolen data is believed to include records from multiple private healthcare providers, further broadening the potential impact of the breach. The NHS is working to increase its capacity for blood tests and has managed to restore some level of service, but significant limitations remain.

 

As the UK government weighs its options, the broader cybersecurity community, including experts like Tim Mitchell from Secureworks, note that the public posting of the data likely signals the end of ransom negotiations, suggesting that Qilin's demands were not met. Synnovis, the joint venture targeted in the attack, has not confirmed whether it engaged in any negotiations with the hackers.

 

Credit: The Guardian 2024-06-25

 

Get our Daily Newsletter - Click HERE to subscribe

4 hours ago, Social Media said:

The UK government is contemplating retaliatory measures against Russian hackers following the theft of 300 million patient records from the NHS.

 

Why no mention of who goofed up and left this information vulnerable and what steps are being taken to ensure it does not happen again? 

Was in incompetence?

1 hour ago, expat_4_life said:

 

Why no mention of who goofed up and left this information vulnerable and what steps are being taken to ensure it does not happen again? 

Was in incompetence?

 

It is utter incompetence. However you would be even dumber to give details of the exploit publicly.

Makes Thailand's constant use of paper look futuristic !

Russia declared an online war against the West long before they brutally attacked Ukraine. It is high time the West responds to Russias' (and others) cyberattacks, using every and all means at our disposal.

1 hour ago, RichardColeman said:

Makes Thailand's constant use of paper look futuristic !

You have a point.

 

However, it is really not that hard to make information secure, if the proper foolproof systems and routines are in place, which in this case it seems they weren't..

Edited June 25, 20242 yr by Excogitator

7 hours ago, Social Media said:

if the Qilin gang has made copies and is able to repost the information elsewhere

 

I've never heard of Qilin gang.

 

The name Qilin is a Chinese word, not Russian.

 

Hackers from China and North Korea are capable of conducting highly sophisticated attacks.

massive incompetency in uk is mind blowing. 

Wait: Rishik, Boris, Teresa, Cod's Eye, that drooling fatso... Isn't it somehow within?