Cyber criminals have launched a staggering 11 million attacks on NHS email systems over the last three years, according to official data from NHS Digital.
The findings, which were released to IT access management security specialist, Centrify, under Freedom of Information (FOI) legislation, paint a disturbing picture of the threats posed to the NHSmail infrastructure system, which is used by more than half a million staff on a daily basis in England and Scotland.
According to the information released by NHS Digital, the NHSmail system blocked a total of 11,352,000 email attacks over the three-year period.
The highest-ranked attacks were those categorised as IP or domain reputation attacks, of which 6,120,000 were recorded.
The second-highest category was anti-spam, which was logged at 3,624,000 attacks.
It’s clear that hackers view the NHS as a top target, with growing volumes of email attacks deliberately designed to fool doctors, nurses and other health service workers into handing over confidential data
And there were 852,000 recorded incidents categorised as anti-virus.
The news comes just over two years since the notorious WannaCry hack of May 2017.
The worldwide ransomware attack targeted computers running the Microsoft Windows operating system, affecting at least 80 of the 236 trusts across England, and leaving the NHS with a £73m IT bill.
And it followed recent warnings in a whitepaper by Imperial College, which stated that, due to a combination of outdated computer systems and a lack of skills and awareness in cyber security; NHS hospitals are still at risk.
Commenting on the findings, Andy Heather, vice president of Centrify, told BBH: “It’s clear that hackers view the NHS as a top target, with growing volumes of email attacks deliberately designed to fool doctors, nurses and other health service workers into handing over confidential data.
It’s vital that hospitals adopt a zero-trust approach to all user activity, ensuring every employee is verified and they are who they say they are
“Increasingly we’re seeing cyber criminals gaining access to private information like patient records using legitimate log-in details which have been stolen or sold online.
"All too often this means that malicious activity remains undetected before it’s too late, so it’s vital that hospitals adopt a zero-trust approach to all user activity, ensuring every employee is verified and they are who they say they are.”
