U.K. National Health Service Targeted with Over 40,000 Email Scams Aimed at Stealing Patient Data

uk national health service scam emailThe last few months have been very busy for cyber attackers targeting the NHS, as the number of phishing emails reported within the NHS shows a continual barrage of attacks.

The U.K.’s National Health Service (NHS) safeguards patient data for all U.K. residents – a treasure trove for cybercriminals. According to data obtained via a Freedom of Information request by UK think tank, Parliament Street, the NHS’ malicious email reporting system received a total of 43,108 reports of suspicious emails received by NHS doctors, nurses and other staff between March and mid-July.

Email-based attacks included scams targeting HR employees using emails impersonating employees asking for payroll banking details to be changed, as well as attacks targeting employees using malicious links that supposedly would allow employees to validate their information to receive their paycheck.

Regardless of the specific scam, 43K phishing emails that made it all the way to the Inbox is eye-opening. It should send the message that organizations can’t assume security solutions will keep malicious emails from reaching the user.

According to NHS Digital’s CIO, Neil Bennet, phishing attacks are the greatest concern. “As phishing emails continue to be the most prominent vehicle to infiltrate or disrupt systems, I would urge staff to verify every email they receive."

Organizations need to go beyond simply advising employees to “watch out” and implement Security Awareness Training that will educate employees on why they need to care, what they need to be on the lookout for, and how to spot malicious or suspicious emails.

Find out which of your users' emails are exposed before the bad guys do.

Many of the email addresses and identities of your organization are exposed on the internet and easy to find for cybercriminals. With that email attack surface, they can launch social engineering, spear phishing and ransomware attacks on your organization. KnowBe4's Email Exposure Check Pro (EEC) identifies the at-risk users in your organization by crawling business social media information and now thousands of breach databases.

EECPro-1Here's how it works:

  • The first stage does deep web searches to find any publicly available organizational data
  • The second stage finds any users that have had their account information exposed in any of several thousand breaches
  • You will get a summary report PDF as well as a link to the full detailed report
  • Results in minutes!

Get Your Free Report

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe To Our Blog

New call-to-action

Get the latest about social engineering

Subscribe to CyberheistNews