An Analysis of a Recent Ransomware Attack on London Hospitals

The recent ransomware attack on London hospitals by the Russian group Qilin has had severe consequences for the National Health Service (NHS). Hundreds of operations and appointments have been canceled in the aftermath of the attack on NHS provider Synnovis, disrupting pathology services primarily in southeast London. The attack has affected King’s College, Guy’s and St Thomas’ hospital trusts, as well as clinics and doctors’ practices across the city. Due to the severity of the attack, a memo was issued to staff declaring it a “critical incident” with a “major impact” on services, particularly blood transfusions.

Concerns have been raised over a reported data dump of patient records following the ransomware attack. According to reports, Qilin shared almost 400GB of data, including patient names, dates of birth, and descriptions of blood tests, on their darknet site and Telegram channel. It was revealed that records covering 300 million patient interactions, such as blood tests for HIV and cancer, were stolen during the attack. This breach of sensitive patient information has prompted the National Health Service to set up a website and helpline for affected patients, acknowledging the distress caused by the incident.

NHS England has acknowledged that data connected to the attack has been published online, leading to the involvement of the National Crime Agency and National Cyber Security Centre in the verification process. The complexity of the data involved in the attack may prolong the investigation, with NHS England stating that such investigations can take weeks or longer to complete. It is crucial for the authorities to conduct thorough investigations to assess the extent of the data breach and its implications for patient privacy.

The Response to the Attack

The National Crime Agency has taken the lead in the criminal investigation but refrained from providing further details at this time. Ransomware attacks, such as the one orchestrated by Qilin, involve criminals using malware to paralyze computer systems and demanding money for their release. This form of cybercrime is not only costly but also disruptive, impacting various sectors including local governments, court systems, hospitals, schools, and businesses. The difficulty in combating ransomware lies in the fact that most criminal gangs operate from former Soviet states beyond the reach of Western justice.

Qilin, also known as Agenda, is the group responsible for the recent ransomware attack on London hospitals. The group advertises on dark web cybercrime forums and leases malware to affiliates for conducting attacks in exchange for a percentage of ransom payments. Louise Ferrett of Searchlight Cyber, a threat intelligence company, revealed that Qilin has listed more than 100 victims of their attacks. The group’s activities highlight the sophisticated nature of cybercrime and the challenges faced by security agencies in combating such threats.

The ransomware attack on London hospitals by the Russian group Qilin has exposed vulnerabilities in the healthcare sector’s cybersecurity infrastructure. The breach of patient records and the disruption of vital services underscore the importance of robust cybersecurity measures to safeguard sensitive data and prevent future attacks. The response to this incident will be crucial in determining the extent of the damage and the steps needed to mitigate the risks posed by cyber threats in the healthcare sector.