NHS 111 services are down for much of the UK following a cyber-attack Thursday morning against the hosting infrastructure of software vendor Advanced. The company's Adastra system is used by 85% of 111 call handlers to dispatch ambulances, to book urgent care appointments, and for out of office hours emergency prescriptions. It's Caresys software is used extensively across more than 1,000 care homes, while Carenotes, Crosscare and Staffplan are used extensively by providers. Advanced supplies software to NHS facilities and doctors nationally, including hospitals, doctors' offices, care homes and mental health services, so disruption has been widespread across the UK.
The systems outage is causing significant delays as call handlers are forced to use other systems or to revert to paper. Emergency ambulance dispatch is taking priority it has been reported, meaning that everyone else has to wait. Meanwhile, applications managed by Advanced have been isolated to prevent lateral spread of malware to other NHS systems.
According to the Telegraph, the cyber-attack appears to have been conducted by an organized criminal ransomware group looking to shut down crucial systems rather than a hostile nation-state as had been originally feared. Healthcare and other critical national infrastructure services have been on high alert since the start of the war in Ukraine given heightened tensions with Moscow. The UK's National Cyber Security Centre is working with the NHS as it attempts to recover systems from backups and restore services.
UK businesses have been warned about paying ransoms and incentivizing extortionists. According to the Telegraph last month, the head of the UK's National Cyber Security Centre (NCSC) and the Information Commissioner warned businesses that they risked “incentivizing” attacks by cybercrime gangs if submitting to ransom demands.
According to Sky News, Advanced, said the issue was contained to "a small number of servers" representing 2% of its health and care infrastructure. Chief operating officer Simon Short added: "We continue to work with the NHS and health and care bodies as well as our technology and security partners, focused on recovery of all systems over the weekend and during the early part of next week."
This latest cyber-attack against the NHS is an unwelcome test of its resiliency and preparedness for various outages including cyber-extortion. As a critical infrastructure industry, the NHS is a target for pariah nation state attack, although in this case evidence appears to suggest that the attack was orchestrated by a Russian criminal gang. Given the known close working relationship between the Russian government and the country's organized crime gangs, the Kremlin may not be entirely off the hook in this case. A forensic investigation of the cyberattack will take time and a positive attribution of the attackers may be many months away.
NSH 111 services previously known as ‘NHS Direct' is used for non-emergency Urgent Care services and puts callers in touch with highly trained advisers, supported by healthcare professionals. It was designed to reduce the call volume on the UK's 999 Emergency services (similar to the US's 911 call system) for non-critical healthcare issues, or to force patients to have to wait several days for an appointment with their general practitioner / primary care provider. The free 111 service is widely used and can be accessed by anyone dialing the number from within the UK.
Advanced is owned by Vista Equity Partners and BC Partners.
