NHS Software Provider Fined £3M for Security Failures Leading to Data Breach

The Advanced Computer Software Group, an IT provider for the NHS, has been fined £3 million by the UK’s Information Commissioner’s Office (ICO) due to security lapses that led to a ransomware attack. The breach, which occurred in August 2022, exposed the personal data of 79,404 individuals, including phone numbers, medical records, and home entry details for 890 home care patients. Hackers gained access using an inadequately protected customer account that lacked multi-factor authentication.

The ICO’s investigation determined that Advanced had insufficient security measures in place before the cyberattack. The attack disrupted key NHS services, including NHS 111, and prevented healthcare staff from accessing patient records. The software used for patient check-ins was also affected. While Advanced had implemented multi-factor authentication in many areas, gaps in coverage left vulnerabilities that the ICO deemed unacceptable.

Originally, the ICO proposed a £6 million fine, but it was reduced to £3 million due to Advanced’s cooperation with authorities and cybersecurity experts. The Information Commissioner, John Edwards, emphasized that the case serves as a warning for organizations handling sensitive data to ensure robust security measures, stating that no part of a system should be left vulnerable.