Salin_NHS IT supplier held to ransom by hackers

[Salin Sirinam]

Description of the case study:
In 2022, the NHS’s IT provider, Advanced Computer Software Group, was attacked by ransomware. Advanced provided software for many parts of the UK health service, including patient referral, ambulance dispatch, booking appointments, and other health services.

Reference:
– https://www.bbc.com/news/technology-62506039
– https://www.theguardian.com/technology/2022/aug/11/nhs-ransomware-attack-what-happened-and-how-bad-is-it

Impact of the breach:
The attack caused a data breach that exposed sensitive personal information of patients across the UK, including medical records and phone numbers, putting around 80,000 people at risk. This attack also disrupted the medical workers’ access to patient histories, making them unable to provide clinical decisions and management in various segments such as the emergency unit and mental health trusts. The details of how to gain entry to the homes of 890 people receiving home care were also leaked. Therefore, this consequence raises both privacy and physical safety risks.

How the data breach occurred:
The attacker was revealed to have gained the access through a customer account that was linked to personal information.

The main cause of the data breach:
According to the ICO investigation, multiple causes were revealed
– Incomplete multi-factor authentication. This measure was not consistently enforced in the system. Therefore, the hackers were able to access the personal account more easily.
– The provider had no solid process to identify and fix the weak points in the system regularly. Moreover, they ignored the national alerts to fix the weakness in the system as well.

How to prevent this data breach attack:
– MFA should be enforced to cover the user accounts
– The systematic, structured policy need to be introduced, covering the clear plan of active threat detection
– The software provider should proactively identify the vulnerable points across the system, including working closely with the other stakeholders, such as the NHS and the national security agencies.

[Jenny Bituin]

Since the healthcare breach was from an attack to third-party vendor (Advanced Computer Software Group), this can be prevented by doing a third-party risk management (TPRM) in order to identify, assess, and mitigate risks associated with outsourcing tasks to third-party vendors or service providers.

[Yin Moe Khaing]

Thanks for identifying the key issues, such as the incomplete implementation of multi-factor authentication (MFA) and the lack of a proactive security strategy. I would like to add The Zero Trust architecture could further enhance the system’s security posture. In this model, no user or device is trusted by default, and strict identity verification, authorization, and least-privilege access principles are enforced at every layer of the network. This would make it significantly more difficult for attackers to move laterally once they’ve gained access through a compromised account.

[Nang Phyoe Thiri]

Thank you for sharing the case and your point of view. In my opinion, role-based access control, data segmentation/modular architecture and enforcing customer awareness about cybersecurity can also be done in this case.

[Author]

Posts