U.K. National Health Service Targeted with Over 40,000 Email Scams Aimed at Stealing Patient Data

The last few months have been very busy for cyber attackers targeting the NHS, as the number of phishing emails reported within the NHS shows a continual barrage of attacks.

The U.K.’s National Health Service (NHS) safeguards patient data for all U.K. residents – a treasure trove for cybercriminals. According to data obtained via a Freedom of Information request by UK think tank, Parliament Street, the NHS’ malicious email reporting system received a total of 43,108 reports of suspicious emails received by NHS doctors, nurses and other staff between March and mid-July.

Email-based attacks included scams targeting HR employees using emails impersonating employees asking for payroll banking details to be changed, as well as attacks targeting employees using malicious links that supposedly would allow employees to validate their information to receive their paycheck.

Regardless of the specific scam, 43K phishing emails that made it all the way to the Inbox is eye-opening. It should send the message that organizations can’t assume security solutions will keep malicious emails from reaching the user.

According to NHS Digital’s CIO, Neil Bennet, phishing attacks are the greatest concern. “As phishing emails continue to be the most prominent vehicle to infiltrate or disrupt systems, I would urge staff to verify every email they receive."

Organizations need to go beyond simply advising employees to “watch out” and implement Security Awareness Training that will educate employees on why they need to care, what they need to be on the lookout for, and how to spot malicious or suspicious emails.