The NHS is investigating a cyberattack claimed by the extortion group Clop, which listed the NHS.uk domain on its leak site on November 11 without publishing any stolen data. The attack reportedly exploits a vulnerability in Oracle E-Business Suite (EBS), a system widely used across the NHS for managing sensitive patient data. While Clop did not specify which NHS branch was compromised, the potential exposure of patient records—given the NHS’s role as Europe’s largest employer and a critical healthcare provider—poses severe risks. The NHS, which refuses to pay ransoms, is collaborating with the National Cyber Security Centre (NCSC) to assess the breach. Historical attacks on the NHS have disrupted life-saving services, and this incident could similarly threaten patient safety if systems are compromised. The UK’s proposed ban on ransom payments for public sector organizations further complicates recovery efforts, leaving the NHS vulnerable to prolonged operational and reputational damage.

The NHS has faced disruptions from ransomware attacks, which have crippled services for days or weeks, contributed to a death, and upended schedules for countless medical procedures. The UK government is proposing measures to ban public sector organizations, including the NHS, from paying ransomware demands to protect critical services and undermine the criminal ecosystem.

United Kingdom's National Health Service (NHS) 111 emergency services targeted by a cyberattack that hit the systems of British managed service provider (MSP) Advanced. Until the situation was fixed, the UK public was recommended to use the online portal to access NHS 111 emergency services.

The NHS fell victim to the WannaCry ransomware attack in 2017, which exploited email-borne phishing tactics to infiltrate systems. The malware encrypted critical patient data, crippling internal networks across multiple hospitals and GP practices. Over 19,000 appointments were canceled, including emergency surgeries and diagnostics, while ambulances were diverted due to locked systems. The attack disrupted radiotherapy for cancer patients, delayed lab results, and forced staff to revert to pen-and-paper records, creating chaos in an already strained healthcare environment. The financial toll exceeded £92 million in immediate recovery costs, with long-term expenditures for IT upgrades and cybersecurity training pushing losses higher. Beyond finances, the attack eroded public trust, exposed systemic vulnerabilities in legacy IT infrastructure, and highlighted the NHS’s reliance on outdated Windows XP systems. The incident underscored how phishing—via malicious email links—can escalate into a nationwide crisis, paralyzing life-saving services and endangering patient lives. While no direct fatalities were confirmed, the delayed treatments and operational shutdowns posed severe risks to vulnerable populations.

NHS fell victim to a data security breach in England that impacted 26 million NHS patients’ records. Concerns have been raised by the Information Commissioner that the records maintained by 2,700 practices.