UK Software Provider Fined £3 Million for Ransomware Attack Affecting NHS

Advanced Computer Software Group penalized for security lapses that exposed personal data of over 79,000 individuals.

The Information Commissioner’s Office (ICO) in the United Kingdom has imposed a fine of £3 million on Advanced Computer Software Group due to security deficiencies that culminated in a ransomware attack in 2022, significantly disrupting National Health Service (NHS) operations.

The breach, which occurred in August 2022, involved unauthorized access to systems within Advanced's health and care subsidiary.

The hackers exploited a customer account that lacked multi-factor authentication (MFA), leading to substantial disruption of essential services, including NHS 111, and preventing healthcare staff from accessing vital patient records.

The ICO's investigation revealed that personal information of 79,404 individuals was compromised during the incident.

This included specific details that could compromise the safety of 890 individuals receiving home care, such as instructions on how to enter their residences.

Following the attack, the ICO determined that the cybersecurity measures implemented by the affected subsidiary were insufficient in safeguarding sensitive personal data.

Despite having installed MFA on several systems, the absence of comprehensive application allowed the breach to occur, highlighting deficiencies in the organization’s overall cybersecurity framework.

Information Commissioner John Edwards noted that the security protocols employed by Advanced’s subsidiary did not meet the expected standards for handling a substantial volume of sensitive information.

He stated, "While Advanced had installed multi-factor authentication across many of its systems, the lack of complete coverage meant hackers could gain access, putting thousands of people’s sensitive personal information at risk."

Edwards emphasized the importance of trust in handling personal medical records, stating that individuals should not need to worry about the safety of their information.

He warned that organizations must implement robust security measures to avoid becoming targets of cyber incidents, which have been on the rise across various sectors.

Earlier in the process, the ICO had proposed a fine of just over £6 million, but the final penalty was reduced as a result of Advanced's proactive cooperation with the National Cyber Security Centre (NCSC), the National Crime Agency (NCA), and the NHS following the incident.