Advanced software provider attacked, disrupting NHS 111 and patient systems

The Advanced software provider, which supports NHS 111 and other patient systems, found itself under attack in August 2022, according to a report by the Joint Committee on the National Security Strategy published on 13 December 2023¹. The committee's report records the incident among a series of ransomware attacks on UK organisations and public services, and states that doctors reverted to pen and paper for months, with patient care badly affected in some care settings¹.

The report does not give the number of NHS organisations affected, the duration of disruption in days, or the cost of the incident. It does not name the attackers or say whether a ransom was demanded or paid in this case. Those details have not been reported in the committee's report¹.

The committee places the Advanced attack in a wider pattern. It cites the WannaCry ransomware attack in 2017, which affected over 200,000 computers in more than 150 countries and had a huge impact on the NHS, affecting at least 34% of trusts in England¹. WannaCry was estimated to have cost the health service around £92 million through lost services, thousands of appointments and operations were cancelled, and patients in five areas had to travel to A&E departments elsewhere¹. The report also records that the number of attacks against UK victims increased by 233% between 2020 and 2021, and that the volume of ransom payments quadrupled¹.

The committee describes ransomware as the UK's foremost cyber security risk, as identified by the Government, and sets out how attacks unfold: attackers gain access, escalate their privileges, extract data, then activate malware that locks systems while demanding payment, usually in cryptocurrency¹. It notes that even if a ransom is paid, the victim may not regain access to all their files¹.

Why it matters for households

NHS 111 and other patient systems are the routes households use to get urgent advice, appointments and test results. The committee's account indicates that when a supplier of those systems is attacked, disruption can last months rather than hours, and that some care settings were badly affected¹. The report does not set out which regions or services were affected in the Advanced incident, or what alternative arrangements patients were given; those details have not been reported¹.

The committee's wider findings describe the practical shape of such incidents: staff without access to records, telephone and email systems, and services that take months to restore¹. Its account of Redcar and Cleveland Borough Council records that recovery took eight and a half months after a February 2020 attack, with no telephone, no emails, no functioning computers and no records or documents¹. The report also records that Hackney Council's October 2020 attack disrupted council services for months and cost over £12 million, and that Gloucester City Council faced costs of around £800,000 after malware in December 2021 caused delays to benefits payments, property sales and planning applications¹.

For households, the committee's evidence points to the value of keeping separate records of appointments, prescriptions and contact numbers, and of knowing how a service will contact people when its own systems are down. The National Cyber Security Centre's guidance for individuals and families is set out in the site's guide to NCSC help for individuals and families, and the practical steps for households during an outage are covered in NHS appointments, A&E and tests during an IT outage. How regulators and the NHS respond to a major incident is explained in how the NHS, government and regulators respond, and the wider picture is set out in the guide to cyber attacks and major IT failures.

What happens next

The committee's report was published on 13 December 2023 with recommendations to government, and the Government has two months to respond¹. The report also records that on 4 December the Government confirmed its commitment to provide up to £10 million of new funding for research on risks to the economy and the public finances¹. No further details of the response to the Advanced incident are given in the report¹.