A cyber incident at University College London Hospitals NHS Foundation Trust (UCLH) involved a software product used to manage mobile phones and tablets being briefly compromised. Although the product did not contain patient data or staff passwords, it did contain some staff mobile and IMEI numbers. The vulnerability in the software allowed hackers to access, explore, and run programs on the target's systems using an IP address based in China. While the software vulnerability has been fixed, there is a risk that hackers could access other data like patient records and further parts of the network via remote code execution.

University College London Hospitals (UCLH) NHS Foundation Trust suffered a cyber attack exploiting a vulnerability in Ivanti Endpoint Manager Mobile (EPMM), a third-party tool used to manage employee mobile devices. The breach, originating from a China-based IP address, exposed staff data, including mobile numbers and IMEI identifiers (unique device codes). While UCLH confirmed no evidence of patient data or password compromise, the incident underscored critical gaps in supply chain security within the NHS. The flaw, discovered on May 15th and later patched by Ivanti, was part of a broader campaign targeting organizations globally, including agencies in Scandinavia, the US, Germany, and South Korea. The attack did not disrupt operations but raised concerns over vendor risk management and the NHS’s reliance on third-party software. Cybersecurity experts, including those from NHS England and EclecticIQ, assisted in investigations, while analysts warned of persistent threats to healthcare infrastructure. This incident follows a pattern of NHS cyber attacks, such as the June 2024 Synnovis ransomware attack (disrupting London hospital procedures) and the November 2023 Wirral University Teaching Hospital breach. The NHS has since introduced a cybersecurity charter to enforce stricter vendor controls, including mandatory patching, MFA, immutable backups, and 24/7 threat monitoring to mitigate future risks.