Patient data could have been stolen in a cyber-attack on an NHS software supplier, experts have warned, as an internal memo reveals the incident has badly disrupted the functioning of several key health services.
Areas of the health service affected include the 111 telephone advice service, GP surgeries and some specialist mental health trusts.
The National Cyber Security Centre (NCSC) and other government agencies are trying to discover the scale of the damage caused by the incursion, amid fears that sensitive medical information may have been taken during the process.
Advanced, which provides services for NHS 111 and patient records, confirmed late on Wednesday it had been hit by ransomware during last week’s attack.
The UK company said it was investigating “potentially impacted data” and that it would provide updates when it had more information about “potential data access or exfiltration”.
The NCSC, which is part of GCHQ, said it was “working with the company to fully understand the impact, while supporting the NHS”. The attack affected 111 services across the UK.
The Information Commissioner’s Office, the data watchdog, confirmed it was aware of the incident, which took place on Thursday 4 August, and was “making inquiries.”
A leaked internal NHS England document, seen by the Guardian, has disclosed that “a number of NHS services, including NHS 111, some urgent treatment centres and some mental health providers use software that have been taken offline”.
“This presents a significant challenge to these services,” it added.
The paper also warns that fixing the IT problems created by the hack “may take some time”. Even after Advanced brings forward a purported solution, it will take “potentially 10-12 days” for things to return to normal.
This is due to needing “to undertake their own assurance, configure their systems and resolve issues that may have been created by the outage”. NHS Digital will also need to approve Advanced’s plan as “safe”, it adds.
The memo adds that 111 has a litany of problems after the attack, including:
The service taking longer to answer calls.
Handlers being unable to book a GP appointment, either at a family doctor surgery or access hub.
Being unable to book patients slots at a pharmacy, to pick up medicines, or with a dental care provider.
GP services may get more patients than usual because of the problems arising from the cyber-attack, the document adds, with family doctors being asked to manage patients themselves who they would normally tell to call the advice service.
In addition, for staff at GP hubs, “access to patients’ NHS numbers will not be available for the duration of this incident”, because electronic patient records are unavailable.
However, “NHS numbers can be found retrospectively” and “GP access hubs should accept patient referrals with no NHS number”.
The NHS Confederation said NHS staff, especially GPs, are expected to face a massive task inputting paper notes and checking in on patients once the disruption is over.
The internal NHS England memo said there is “currently no evidence to suggest that patient data has been compromised”. However, it is understood that the security of patient data is still under investigation.
Alexi Drew, an information security consultant, said the information commissioner’s involvement indicated serious concerns about whether patient data had been taken.
“If the ICO is involved, they have to think that there is a credible risk that personal data has been stolen,” she said.
The Health Service Journal reported on Wednesday that a “system outage” of the Carenotes electronic patient record – an Advanced product – had affected at least nine NHS mental health trusts. Advanced software is used in 36 acute trusts or mental health trusts in England, according to Digital Health Intelligence.
The attack has also affected the Advanced Adastra system, which helps 111 administrators dispatch ambulances and is a patient management system for emergency care.
An NHS England spokesperson said: “While Advanced has confirmed that the incident impacting their software is ransomware, the NHS has tried and tested contingency plans in place including robust defences to protect our own networks, as we work with the National Cyber Security Centre to fully understand the impact.
“The public should continue to use NHS services as normal, including NHS 111 for those who are unwell, although some people will face longer waits than usual, as ever if it is an emergency, please call 999.”
Alan Woodward, a professor of cybersecurity at Surrey University, said any patient data on the affected Advanced systems would be at risk.
He said: “Even if it was ransomware … that doesn’t mean data was not stolen. Ransomware has evolved to not simply encrypt the data on the users’ devices but also to steal the data (the item of real value) and demand a ransom for its safe return/destruction.”
Advanced said it believed it had “contained” the incident but some services could take weeks to recover.
“With respect to the NHS,” it said. “We are working with them and the NCSC to validate the additional steps we have taken, at which point the NHS will begin to bring its services back online.
“For NHS 111 and other urgent care customers, we anticipate this phased process to begin within the next few days.
“For other NHS customers, our current view is that it will be necessary to maintain existing contingency plans for at least three to four more weeks.”
