Alder Hey Children’s Hospital Trust has confirmed it has suffered a data breach after sensitive information including medical records was published on the dark web and shared on social media.
The trust updated its previous statements to confirm that it suffered a single cyber incident where threat actors were able to gain unlawful access to sensitive data through a digital gateway service.
The trust said the exposure has impacted patients from three facilities in the Liverpool area, with hackers able to steal data from Alder Hey Children’s NHS Foundation Trust, Liverpool Heart and Chest Hospital, and Royal Liverpool University Hospital (RLUH).
The trust has launched an investigation into the incident, which it says is still ongoing, to determine the specific details of the intrusion and establish exactly what types of data were taken.
According to the trust’s website, it provides care to more than 450,000 young people each year and employs over 4,000 staff, making it one of Europe's biggest and busiest children’s hospitals.
Liverpool Heart and Chest Hospital is relatively smaller, with just over 100,000 patients each year, including virtual appointments.
RLUH is the largest hospital in the region, caring for over 750,000 patients each year, although Alder Hey’s statement clarified that the incident only impacted a “small amount of data from Royal Liverpool University Hospital".
No hospital services were affected and continue to operate, with patients advised to continue attending appointments as they normally would do so.
“As part of our response to this threat we have made progress in securing impacted systems and ensuring the attackers do not have continued access. This means that we are in a position to begin to reconnect our systems when it is safe to do so,” the statement clarified.
The incident first came to light on 28 November after the threat actor Inc Ransom posted on its dark web leak site, claiming to have stolen sensitive patient records from Alder Hey.
Alder Hey said it is still trying to establish whether or not the attacker did, in fact, obtain confidential data, but warned this process could take a while.
“We are continuing to take this issue very seriously while investigations continue into whether the attacker has obtained confidential data. The investigation into the data may take some time, and there is a possibility that the attacker may publish the data before our investigation is concluded.”
