UK Alder Hey Children’s NHS Foundation Trust Hospital Confirms INC Ransom Cyber ​​Attack

A ransomware group is targeting one of Europe’s largest children’s hospitals, although the hospital says no children’s data appears to be affected.

The INC Ransom ransomware gang listed Alder Hey Children’s NHS Foundation Trust as a victim on its darknet leak site and shared medical records of several patients to prove the success of the hack.

Hackers listed the hospital on November 28, with the hospital confirming the incident on December 4.

“Criminals gained illegal access to data through a digital gateway service shared by Alder Hey and Liverpool Heart and Chest Hospital,” the hospital said in an update of the incident on its website.

“This allowed the attacker to illegally access systems containing data from Alder Hey Children’s NHS Foundation Trust, Liverpool Heart and Chest Hospital, as well as a small amount of data from the Royal Liverpool University Hospital.”

Hospital services were not affected by the hack and patients were asked to attend their appointments as normal.

“Work continues with the National Crime Agency to secure affected systems and take further action in line with advice from law enforcement,” the hospital said.

“We are also following guidance from the Information Commissioner’s Office and will ensure that anyone affected by this data breach is contacted directly and supported.”

In a second update on December 5, the hospital said that although some patient data appears to be affected, “we do not believe that the data illegally published or accessed relates to children and young people.”

However, even though no data on children appears to have been accessed, the documents already released by INC Ransom include medical reports belonging to adult patients. Personal data includes names, dates of birth, details of medical procedures and results. Other documents include personal details of hospital donors and their donations, cost improvement plans and financial data.

According to the hackers, the documents date from between 2018 and 2024, and although the total amount of data exfiltrated was not disclosed, INC Ransom said the breach included “large-scale data.”

INC Ransom has not indicated a ransom demand or a date when it will release the full dataset.

Meanwhile, the hospital continues to investigate the incident.

“We continue to take this matter very seriously as investigations continue to determine whether the attacker obtained confidential data. “It may take some time to investigate the data and it is possible that the attacker may release the data before our investigation is concluded,” the hospital said.

Alder Hey Children’s NHS Foundation Trust continues to work with the UK National Crime Agency and the Information Commissioner’s Office.

“As soon as we are able to provide an update on the impact on people’s data, we will provide a further update,” the hospital said.