The hacker group behind a ransomware attack on NHS Dumfries and Galloway has followed through on its threat to publish stolen data online, with authorities reporting that a “large volume” of sensitive information has been leaked.
The health board first reported a cyber incident in March, with threat actors releasing a small amount of stolen data as proof of their attack. The full stolen dataset, believed to be around 3TB, included confidential information pertaining to both staff and patients.
According to the health board, the full dossier of stolen data has now been published to the dark web.
Julie White, chief executive of NHS Dumfries and Galloway, described the cyber attack as an “utterly abhorrent criminal act” and said the health board is coordinating with authorities to support those affected.
“We should not be surprised at this outcome, as this is in line with the way these criminal groups operate,” she said. “Data accessed by the cyber criminals has now been published onto the dark web – which is not readily accessible to most people.
“Work is beginning to take place with partner agencies to assess the data which has been published. This very much remains a live criminal matter, and we are continuing to work with national agencies including Police Scotland, the National Cyber Security Centre and the Scottish Government.”
The health board advised patients and staff to remain vigilant of potential attempts to “access their work and personal data,” and said those approached by anyone claiming to possess stolen personal data should contact the police.
What happened with the NHS Dumfries and Galloway attack?
NHS Dumfries and Galloway revealed it had suffered a “focused and ongoing cyber attack” on 15 March 2024 and that a “significant quantity” of patient and staff data had been accessed.
Ryan McConechy, CTO at Barrier Networks, told ITPro at the time that the incident bore all the hallmarks of the Inc Ransomware group, which has frequently targeted public services and healthcare organizations.
“Inc has a history of attacking healthcare organizations, and most ransomware gangs avoid making false claims around victims as it tarnishes their reputation,” he said.
Inc is a relative newcomer to the cyber extortion landscape, but has claimed several victims across the UK in recent months.
In late March, the group claimed responsibility for an attack on Leicester City Council which severely disrupted services at the local authority.
That incident marked the second attack by the group within a matter of weeks. Once again, Inc ‘flashed’ details of the incident on its leak site, claiming to have stolen 3TB of sensitive data from internal systems.
