NHS England’s technology provider confirms the data breach

DXS International, a UK-based company that provides healthcare technology to England’s National Health Service (NHS), disclosed the cyberattack in a statement on Thursday.

In a filing with the London Stock Exchange, the company said it had experienced a “security incident affecting its office servers,” which was discovered on December 14. The company said it “immediately” contained the breach in cooperation with the NHS, and hired a cybersecurity firm to investigate “the nature and extent of the incident”.

“There has been minimal impact on the company’s services and the company’s frontline clinical services remain unaffected and operational,” the filing said.

At this stage, the specific nature of the breach is not known, nor whether any patient’s medical information was stolen.

However, earlier this week, a ransomware group called DevMan claimed responsibility for the hack. In a post on its dark web site, which was seen by TechCrunch, hackers listed the company on December 14 and claimed to have stolen 300 gigabytes of data from the company.

DXS said it had also notified law enforcement and regulators, including the UK’s Data Protection Authority, the Information Commissioner’s Office, or ICO, about the cyberattack.

Stephen Power, DXS’s chief operating officer, did not respond to a series of questions. Instead, Bauer sent TechCrunch a statement echoing the public filing.

Rachana Suwaidan Fegerstaff, a spokeswoman for the ICO, told TechCrunch that the ICO is evaluating the information provided by DXS, while also not responding to many questions.

NHS England spokesperson Katie Baldwin told TechCrunch that the health service is “not aware of any patient services being affected.”

DXS says on its website that it provides software that helps reduce costs for physicians and primary care physicians. As such, the company’s software addresses patient records and data. The company also says that in some cases, its solutions are hosted on the NHS Health and Social Care Network (HSCN), a system for healthcare organizations across the UK to access and share information.

In general, the NHS does not store a patient’s medical data in a central system.

Updated with responses from DXS and ICO.