How the NHS, Government and Regulators Respond to a Major Incident

When a cyber attack disrupts the services your household depends on, the response is not improvised. The National Cyber Security Centre (NCSC) received almost 2,000 reports of cyber attacks across UK government and the private sector in 2024, of which 90 were deemed significant and 12 at the top end of severity, and each of those triggers a defined chain of responders¹. In the NHS, NHS England can declare a major incident and switch to emergency arrangements, as it did within hours of the WannaCry attack in May 2017². At national level, the Home Office claims the lead on ransomware as a national security risk, while lead government departments and regulators such as Ofcom and Ofgem take charge in their own sectors³.

For your household, this matters in practical ways. It determines who tells you what is happening, how long services may be degraded, what compensation or priority help you can claim, and how to spot the scammers who follow every real incident. This page explains the system: how the NHS declares and stands down a major incident, what its CareCERT alert service does, what recent attacks on NHS suppliers have shown, and what happens when phones or power are affected. For what to do in your own home during an outage, see our guides on NHS services during an IT outage and when utility companies are hacked.

Who takes charge when a cyber attack hits the NHS

The NHS has a formal system for escalating a cyber attack, and it moves quickly. The clearest illustration is WannaCry in May 2017. NHS Digital's CareCERT service alerted the Department of Health and Social Care just after 13:00 on 12 May 2017, following reports from four NHS trusts of ransomware attacks⁴. Reports increased as the afternoon went on: by 16:00 the count had reached 16 trusts, and at that point NHS England declared a major incident and implemented its emergency arrangements to maintain health and patient care⁴. The incident was stood down on Friday 19 May².

Declaring a major incident is not a symbolic gesture. It switches the NHS onto its emergency preparedness, resilience and response (EPRR) arrangements: staff are redeployed, appointments are triaged, paper processes replace failed systems, and communications move to a coordinated footing. During a major emergency, the NHS takes the lead on providing information to the public on any health aspects of the response and recovery from that incident⁷. That is why, in a real incident, the advice you receive about appointments, prescriptions and where to go comes from NHS channels rather than from the company that was attacked.

For your household, the practical points are these. Follow the instructions issued by your local NHS organisation, because they reflect the emergency arrangements in force. If you need medical help and cannot get through on affected phone lines, NHS 111 online at 111.nhs.uk is available if you have access to the internet⁸. In an emergency, call 999 as normal. Our page on NHS appointments, A&E and tests during an IT outage covers what to expect in detail.

CareCERT: the NHS's own cyber alert service

Behind the NHS's response sits CareCERT, a cyber alert service run by NHS Digital, and one of only two sector-specific cyber support services in England⁴. Its job is to send alerts to NHS organisations telling them about threats and the actions needed to counter them, and to work with the National Cyber Security Centre when incidents occur⁴.

The WannaCry investigation showed both how the system works and what happens when its warnings are not acted on. After the attack, NHS England and NHS Improvement wrote to every trust, clinical commissioning group and commissioning support unit asking boards to ensure they had implemented all 39 CareCERT alerts issued between March and May 2017 and taken essential action to secure local firewalls².

The follow-up machinery was strengthened. On 12 May 2017, NHS Digital worked with NHS England to put in place a formal mechanism for assessing whether NHS organisations had complied with CareCERT alerts². NHS Digital built a CareCERT Collect portal to provide assurance that trusts had implemented cyber alerts and to collect central data on IT and digital assets in the NHS². Under the 2017/18 Data Security and Protection Requirements published in October 2017, organisations must confirm via CareCERT Collect, within 48 hours, that plans are in place to act on High Severity CareCERT advisories⁴. The NHS Digital Data Security helpline was made available 24/7, with a full service from 9:00 to 17:00 and a national service desk handling out-of-hours calls⁴.

What WannaCry taught the NHS about planning and testing

The National Audit Office's verdict on WannaCry was blunt: it was a relatively unsophisticated attack that could have been prevented by the NHS following basic IT security best practice⁹. It was nonetheless the largest cyber attack to affect the NHS in England⁹. The gap was not the absence of a plan but the absence of tested, followed-through preparation.

Three findings stand out. First, the Department of Health had developed a plan for responding to a cyber attack, including roles and responsibilities, but had not tested the plan at a local level⁹. Second, the Department had been warned about the risks of cyber attacks on the NHS a year before WannaCry, and although work was under way, it did not formally respond with a written report until July 2017⁹. Third, the damage was wider than the first day suggested: between 15 May and mid-September 2017, NHS Digital and NHS England identified a further 92 organisations, including 21 trusts, that had contacted the WannaCry domain².

The lessons-learned review that followed set out what every NHS organisation should now have in place: every board should have an executive director as data security lead, cyber security risks should be regularly reviewed by the board, and counter-measures and response plans should be in place⁴. NHS England was also advised to develop scenarios to ensure it can manage a coordinated or multiple attack, for instance a terrorist bombing combined with a cyber attack⁴. Progress was measurable: by February 2018, 190 independent on-site cyber assessments of NHS trusts had been undertaken⁴.

The wider principle applies to your household as well as to a hospital trust: a plan that has never been rehearsed is not a plan. The same thinking sits behind the government's preparedness campaigns, which encourage every household to check the risks where they live and prepare accordingly. If you want to apply the same discipline at home, our home online security checklist and getting started pages are the place to begin.

Attacks since WannaCry: NHS services and their suppliers

WannaCry was not a one-off, and later incidents have shown the same pattern of disruption to NHS services. One such incident was the Synnovis cyber attack, and the advice that followed it still applies to any household: send suspicious emails to report@phishing.gov.uk or texts to 7726¹⁰. If a cyber attack affects services you rely on, treat unexpected messages claiming to be from the NHS or a supplier with the same caution as any other scam.

The Synnovis incident also shows how the response reaches patients. Synnovis will not contact patients directly; notification comes from an NHS organisation, as determined by UK data protection laws¹⁰. NHS England has been explicit that patients will never be asked for personal or financial information in connection with the incident¹⁰. Synnovis is now in the process of contacting its impacted customers, including some NHS hospitals, GP practices and clinics¹⁰. An NHS Cyber Improvement Programme has continued since June 2024, supporting the NHS to respond to changing cyber threats, expand protection and reduce the risk of a successful attack¹⁰.

Other incidents fill out the picture. In August 2022 an attack on the software provider Advanced disrupted NHS 111 and patient systems, with doctors reverting to pen and paper for months and patient care badly affected in some care settings¹¹. Earlier, Barts Health NHS Trust, one of the largest trusts in the NHS, suffered a cyber attack on 13 January 2017 affecting four hospitals, and WannaCry was the second cyber attack to affect that trust in six months². Royal Cornwall Hospitals NHS Trust had been infected once before 2016 and was the subject of multiple unsuccessful attacks during 2016². Nor is data loss new: the healthcare sector accounted for the highest number of data security incidents reported to the Information Commissioner's Office in the third quarter of 2016, with 74 of the NHS's 239 reports related to cyber security incidents⁴.

If a cyber incident affects your own care or data, the reporting route is the same for organisations of any size: UK-based organisations can report a cyber incident at gov.uk/report-cyber¹². For what to do personally when your details are exposed, see your details in a data breach.

Supply chains: the weak point in critical national infrastructure

The UK's critical national infrastructure (CNI) spans 13 sectors, and the government's resilience planning pays particular attention to vulnerabilities between them¹³. Synnovis showed why: the laboratory itself was not a hospital, but its outage rippled straight through to outpatient appointments and elective surgery in London¹⁴. Local risk registers make the same point in their own terms. Essex's community risk guidance notes supply chain vulnerabilities, meaning cyber attacks on suppliers that affect organisations in the county, and that small and medium enterprises are particularly vulnerable due to reliance on third-party services¹⁵. It also notes that key infrastructure like the Port of Tilbury and Harwich International Port relies on digital systems for logistics and operations, making them targets, and that power grids, water supply or transport systems could be disrupted by cyber attacks¹⁵.

Government response is developing on two fronts. The UK government has announced the upcoming Cyber Security and Resilience Bill, which will ensure that critical infrastructure and the digital services UK citizens and businesses rely on are secure¹. It is also establishing a new Supply Chain Centre, announced in the Industrial Strategy, which will work with businesses and international allies to diagnose acute vulnerabilities and threats, develop policy and targeted interventions to improve the UK's ability to withstand future disruptions¹.

Risk registers track the threat at regional level. The London Risk Register rates the risk of technological failure at a UK critical financial market infrastructure as HIGH, with a next review date of December 2025¹⁶. For households, the lesson is that an attack on a company you have never heard of can still reach you: your bank, your water company, your council or your hospital can be knocked offline by a supplier's outage. Our page on when banks, shops and public services go offline covers how to manage when that happens.

Ransomware and national security: what Parliament has asked government to do

Ransomware has been identified by UK authorities as the number one cyber threat to the nation³, and the UK is one of the most targeted countries in the world for ransomware, with some estimates putting it second only to the US¹¹. The consequences of a major attack are quantified in the Joint Committee on the National Security Strategy's report "A hostage to fortune": a major UK cyber attack, which might take the form of a ransomware attack, could result in a shock to the economy of 1.6% of GDP, adding £29 billion to government borrowing, according to the Office for Budget Responsibility¹¹.

On who leads, the answer is the Home Office, which claims the lead on ransomware as a national security risk and policy issue³. The committee found that the government and the NCSC have focused their counter-ransomware efforts predominantly on resilience³, and it made specific asks: that the government should invest significantly more resources in the National Crime Agency's response to ransomware, and that it should work with the insurance sector to establish a re-insurance scheme for major cyber attacks³.

Legislation is following. Alongside the Cyber Security and Resilience Bill, the government is consulting on three counter-ransomware measures: a targeted ban on ransomware payments for regulated CNI and the public sector, a ransomware payment prevention regime, and a mandatory incident reporting regime¹. The scale of the problem is visible in the NCSC's own figures: during the year to August 2022 the NCSC co-ordinated the national response to 18 ransomware attacks, including attacks on a supplier¹⁷, and ransomware remains the greatest cyber crime threat in the UK¹⁸. With 50% of crime now taking place online¹³, this is a threat that reaches ordinary households as well as ministries. Our page on ransomware and how it affects households explains the mechanics.

Ofcom's role when phone and broadband services fail

When a cyber attack or system failure takes out phone and broadband, Ofcom is the regulator with duties and rules that shape what happens to you. The digital phone switchover has sharpened one issue in particular: traditional landlines worked without mains power, but digital services do not. Ofcom, the communications regulator, requires communications providers to provide a resilience solution which provides power for at least one hour for customers reliant on their landline for emergency calls⁵. Ofcom has also introduced an incident reporting framework whereby communication providers need to report any known incidents of telecare users being harmed by the PSTN migration⁵.

Ofcom also requires providers to serve disabled customers. Ofcom requires communications providers to offer a number of services to disabled people, including priority fault repairs and offering different methods of communication¹⁹. Free services similar to the energy sector's priority register are available in the telecoms sector²⁰. For deaf users, Ofcom rules introduced in 2022 require telephone and broadband companies to offer a free, 24/7 video relay service for contacting 999, the emergency SMS service and non-emergency numbers; telecoms firms can either deliver the service themselves or contract another organisation to do so, but it must be approved by Ofcom²¹. Ofcom requires telecoms providers to make emergency video relay available in the UK²². 999 BSL, EmergencySMS and Relay UK are alternative ways to contact the emergency services²³.

Compensation may follow a prolonged outage. If your provider has registered for Ofcom's automatic compensation scheme and your broadband or landline is not fixed within two working days, you may be entitled to compensation; if your provider has not registered for the scheme, or you have problems with your mobile service, you may still be entitled to compensation²⁴. In severe weather, Ofcom advises vulnerable customers on ways to stay connected, including these entitlements²⁴.

Ofgem's role when the power goes off

A national power outage, whatever its cause, has a defined leadership structure: the Department for Energy Security and Net Zero (DESNZ) is the lead government department for this risk, working with the National Energy System Operator to ensure power restoration, while the Cabinet Office provides oversight, coordination, decision making, situational awareness and public communications¹. Ofgem regulates the companies involved and has shown it will act on their performance. During Storm Arwen, distribution network operators agreed to lift the compensation cap of £700 to enable customers to be adequately compensated for the outages they endured²⁵.

Your first action in a power cut is to report it by calling 105, or your local network operator's number: in one example of heat-related power cuts, the advice was to report it to UK Power Networks by calling 0800 31 63 105 or 105⁶. If you or someone in your household needs extra help, register at the Priority Service Register at thepsr.co.uk to receive extra help in a utility outage if you are eligible²⁶. Eligibility is wider than many people assume: it includes people recovering from an injury, as well as those who are older, disabled or living with a long-term illness²⁰. The register can include priority fault repairs¹⁹.

Ofgem also acts on scams that follow disruptions. To mitigate the threat of scam communications, Ofgem wrote to all energy supplier chief executives asking that they have clear, up-to-date and accessible information on their websites advising customers what to do in case of a scam¹⁷. Many suppliers also operate an ID and password scheme so you know it is really them if they contact you²⁷. Set that up with your supplier before you need it. For what to keep at home during outages, see our guides on power cuts and backup power.

Local Resilience Forums and national risk planning

The ground level of the UK's emergency planning system is the Local Resilience Forum. A Local Resilience Forum is a multi-agency partnership that brings together Category 1 and Category 2 responders under the Civil Contingencies Act 2004 to coordinate planning, preparation and response for emergencies and major incidents within a specific geographical area²⁸. Its members are representatives from local public services, including the emergency services, local authorities, the NHS, the Environment Agency and other organisations involved in emergency preparedness, such as utilities providers²⁹. The numbers differ across the nations: there are 38 Local Resilience Forums in England, four in Wales, three Regional Resilience Partnerships in Scotland, and Emergency Preparedness Groups in Northern Ireland²⁸.

Local Resilience Forums identify potential risks and produce emergency plans to either prevent or lessen the impact of any incident on their local communities²⁹, and your Local Resilience Forum will publish information online about the risks in your local area²⁹. Some go further on cyber specifically. Wiltshire and Swindon's Local Resilience Forum has created a cyber guide for partner organisations to use in response to a cyber attack, which includes arrangements to secure partner and wider support to mitigate the effects of the attack³⁰. In Wales, a Cyber Exercising Strategy offers testing and exercising of Cyber Incident Management Plans to local authorities, Fire and Rescue Services and wider public sector bodies across Wales³¹. Local risk registers also treat cyber attacks on suppliers as a distinct local risk, with collaboration between public and private sectors to improve cybersecurity readiness and incident response¹⁵.

Above the local tier, the UK government uses a Lead Government Department model to cover all phases of emergency planning, response, recovery and risk assessment²⁸. Public warning is part of that machinery: about 95% of the population is covered by 4G or 5G access, which underpins the UK emergency alert system, and the government has said it will work with stakeholders, including domestic violence charities, to ensure the public has as much warning as possible before any test³². The same planning culture extends to health emergencies: the UK government and devolved administrations, including the health and social care system, have planned extensively over the years for events like the COVID-19 pandemic, with responses tailored to the nature, scale and location of the threat³³. For the full picture of how the UK prepares, see how the UK prepares for emergencies.

Scam calls claiming to be from a regulator: hang up

Every real incident is followed by fake ones. Attackers who have stolen data, or who simply know a breach is in the news, pose as the NHS, a regulator or your supplier to extract personal or financial information. The official advice is consistent and simple. You will never be asked for personal or financial information when contacted by the NHS about a cyber incident, and if you receive an unexpected or suspicious message claiming to come from the NHS, verify it by contacting the organisation directly using details from its official website, never an address or phone number from the message itself¹⁰.

Reporting routes are free and quick. Forward scam texts to 7726, free of charge, and send suspicious emails to report@phishing.gov.uk¹⁰. In the UK, you can also report scams, cyber crime and frauds to Action Fraud, either online at www.actionfraud.police.uk or by telephone on 0300 123 2040³⁴. If you have clicked a link or handed over details, act quickly: our pages on what to do if you clicked a phishing link and if you gave your bank details to a scammer set out the steps, and how to spot scam messages after a data breach covers the follow-up scams in detail.