Who are the hackers threatening to leak NHS patient records?

News that hackers have accessed NHS Scotland patient data and are threatening to release it online is many people’s worst nightmare. 

Each individual’s medical history is incredibly private and personal, something no one else should be able to read without the patient’s permission.

However, Ransom Inc, the group behind the attack, has already published what is known as a ‘proof pack’ on its dark web blog, showing a small amount of the data stolen to prove it is has the information.

The board of NHS Dumfries and Galloway has confirmed it is genuine.

But who is behind the attack on NHS Scotland, and what do they want?

Who are Inc Ransom?

The group first emerged in July 2023. In the eight months since, it has targeted businesses, governments and even a charity, carrying out attacks across the globe, although primarily focused on the US and UK. 

The hackers use extortion, threatening to publish sensitive information unless a ransom is paid.

Describing how the group operates, cybersecurity platform SentinelOne said: ‘Operators of Inc. Ransom position themselves as a service to their victims. Victims can then pay the ransom to “save their reputation”, though the threat actors indicate their intention to reveal their methods, making the victim’s environment “more secure” as a result. 

‘Inc. Ransom is a multi-extortion operation, stealing victim data and threatening to leak said data online should the victim fail to comply with their demands.’

NHS Dumfries and Galloway chief executive Jeff Ace said: ‘We absolutely deplore the release of confidential patient data as part of this criminal act.

‘This information has been released by hackers to [offer] evidence that this is in their possession.

‘We are continuing to work with Police Scotland, the National Cyber Security Centre, the Scottish Government, and other agencies in response to this developing situation.’

How does Inc Ransom work?

The group uses a number of methods, including spear-phishing emails and targeting vulnerable systems.

Spear-phishing involves sending malicious emails to individuals or organisations, with the aim of stealing sensitive information such as usernames and passwords, or infecting the user’s device with malware. 

Who else has Inc Ransom attacked?

The group has targeted a wide range of victims, including the metal refining and battery manufacturing industries, IT companies, the hospitality sector, real estate businesses, a pharma lab and even a housing charity.

How can you protect yourself from cyber attacks?

There are a number of ways to prevent cyber attacks.

• Always be wary of links in emails, even if you think they’re from a trusted sender. Don’t just look at the name, but double-check the sender’s address. If it appears to be from a company, go directly to the website rather than clicking on the link. Look out for poor spelling and grammar, often giveaways that it may not be authentic.
• If an email, or anyone, ever tries to instill a sense of urgency in you, particularly while asking for money, step back and take your time to consider the situation. No bank or company will ever pressure you into logging into your account or transferring money in a hurry. If you receive an email from your bank or another financial institution that doesn’t seem right, call them.
• Don’t overshare online – hackers can use personal information to both make more convincing scams and to guess login details.
• Speaking of which, strong, unique passwords are essential to keeping safe online. Don’t use obvious passwords such as P4ssword123, and don’t reuse them. If you struggle to remember them all, use a password manager.
• Install antivirus software on your devices, which adds an extra layer of security.