Hackers could release data from a cyber attack on hospitals before the NHS can investigate, a trust has warned.
Alder Hey Children’s NHS Foundation Trust said criminals gained unlawful access to data through a digital gateway service it shares with Liverpool Heart and Chest Hospital on Thursday November 28.
The trust, which runs a hospital in the same name in Liverpool and other community care facilities, said it has launched an investigation “to determine the full facts around what data has been obtained unlawfully”.
But in a statement on Wednesday, it said the probe may take “some time” and there is a possibility the cyber attackers may publish the data before its investigation is complete.
It is not yet known how many people have been affected by the data breach but the trust said the hackers also accessed a small amount of data from Royal Liverpool University Hospital.
The trust said the criminals have claimed to have extracted data from affected systems and screenshots allegedly containing data retrieved in the attack were published online last week.
“We are continuing to take this issue very seriously while investigations continue into whether the attacker has obtained confidential data,” they said in a statement.
“As part of our response to this threat we have made progress in securing impacted systems and ensuring the attackers do not have continued access.
“This means that we are in a position to begin to reconnect our systems when it is safe to do so.
“Hospital services remain unaffected and continue to run normally. Patients are advised to continue to attend appointments.”
It comes just days after another Merseyside hospital was targeted in a cyber attack.
Wirral’s Arrowe Park declared a major incident on November 25, where patients faced cancelled appointments and long A&E waits.
Alder Hey Children’s NHS Foundation Trust said the incidents were not linked and it is following guidance from the Information Commissioner’s Office (ICO) and ensuring “that anyone impacted by this data breach is contacted directly and supported”.
An ICO spokesperson said: “People’s medical data is highly sensitive information, not only do people expect it to be handled carefully and securely, organisations also have a responsibility under the law.
“Anyone who has concerns about how their information has been handled, should raise it with the organisation first, then report them to us if they are not satisfied with the response.”
