The outsourcing firm behind NHS Test and Trace has confirmed that it was targeted by cyber criminals operating the newly-discovered Babuk ransomware.
Hampshire-based Serco manages over 500 contracts worldwide, operating in sectors such as health, transport, justice, immigration, defence, and citizens services.
Sky News, which first reported on the cyber attack, managed to obtain a confirmation from the company that Test and Trace was not affected in the incident.
If it had, it would add to a growing number of incidents that have affected the system since its launch in May of last year. Between late October and early November 2020, it suffered two software glitches in one week, with more than 7,000 people given the wrong dates for self-isolation. Prior to that, an Excel technical issue led to a delay in reporting 15,841 positive COVID-19 cases.
Speaking to Sky News, Serco spokesperson Marcus Deville said there had been "no impact on UK business" and that the attack had only impacted the company's mainland European operations, which were "completely isolated" from those in the UK.
The publication also found that the cyber criminals had used the Babuk ransomware in the attack, which had only gained notoriety in the last few weeks, with little information available.
RELATED RESOURCE
Ransomware resiliency: The risks associated with an attack and the reward of recovery planning
An overview of the history of ransomware, its potential impact, and best practices to protect IT systems
According to an advisory published last month by NHS Digital, as the Babuk Loader is deployed, it attempts to “terminate various security and recovery services as well as database, browser and email programs”.
“It then encrypts all non-system files on local and network drives using a ChaCha8 implementation, the keys for which are then encrypted using a custom elliptic-curve Diffie-Hellman implementation thought to be based on several components published by the US' National Institute of Standards and Technology.”
Kaspersky principal security researcher David Emm told IT Pro that Babuk is a "fairly new ransomware".
"Whilst reports have suggested that the coding of the malware isn’t very sophisticated, the way the encryption is implemented means that victims can’t decrypt files for themselves," he added.
"It’s also unclear what the attack vector is in this case, although such attacks typically employ social engineering – i.e. tricking staff into doing something that compromises security, such as clicking on an attachment or link in a message.
"This is why developing an in-house security awareness programme is so vital, to ensure that staff understand the tricks cybercriminals use and know what they can do to avoid falling victim to them," said Emm.
According to the ransom note addressed to Serco, the cyber criminals had been "surfing inside [Serco’s] network for about three weeks and copied more than 1TB of your data”. According to Sky News, the hackers also threatened the company with "consequences" if it wouldn’t cooperate "to resolve this situation", warning of risks including falling stock value.
"Your partners such as NATO, or Belgian Army or anyone else won't be happy that their secret documents are in free access in the internet,” it added.
However, it’s currently unknown what exact documents were stolen by the criminals.
IT Pro has contacted Serco for comment and will update this story when more information is available.
-
Enterprises face delicate balancing act with data center sustainability goalsNews High energy consumption, raw material requirements, and physical space constraints are holding back data center sustainability efforts, according to new research from Seagate.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
