The UK’s Information Commissioner’s Office (ICO) has announced a provisional £6.1 million fine for Advanced Computer Software Group, a major IT service provider for the NHS. The fine is in response to a significant ransomware attack that occurred in August 2022, which severely compromised the personal data of nearly 83,000 individuals. This data breach included sensitive information such as phone numbers, medical records, and access details for the homes of 890 people receiving care. The attack also had a substantial impact on NHS operations, disrupting critical services including patient referrals, out-of-hours appointments, emergency prescriptions, and ambulance dispatches.
The ICO’s investigation found that Advanced’s approach to cybersecurity was severely lacking, given the scale and sensitivity of the data they handle. Despite implementing some security measures on their corporate systems, the regulator found that Advanced failed to secure its healthcare systems adequately. The breach was facilitated through a hijacked account that lacked multi-factor authentication (MFA), allowing the attackers to launch a Remote Desktop Protocol (RDP) session and access sensitive data.
Information Commissioner John Edwards criticized Advanced for its failure to maintain robust security practices. Edwards emphasized that organizations handling large volumes of sensitive health data must implement fundamental security measures, including regular vulnerability checks, MFA, and up-to-date security patches. The ICO’s provisional finding underscores the need for all organizations, especially those managing critical health information, to prioritize and enhance their cybersecurity defenses.
In response to the ICO’s proposed fine, Advanced will now prepare a legal response, aiming to contest or negotiate the penalty. The outcome of this process will be closely watched, as it could set a precedent for how similar cases are handled in the future. The situation serves as a stark reminder of the importance of rigorous cybersecurity measures in safeguarding sensitive information against increasingly sophisticated threats.
Reference:
