Multiple UK councils have warned that citizens' personal data may have been breached following a ransomware attack on a medical equipment supplier.
Nottingham Rehab Supplies Healthcare, which supplies health and care equipment numerous local authorities across the UK, was hit by a ransomware attack at the start of April 2024.
The attack resulted in the NRS website being taken offline.
A number of UK local authorities have now revealed that NRS has informed them that personal data of residents may have been breached by the attackers.
East Lothian Council said in a statement on May 14 that specialist teams are currently investigating the extent of the attack, although it does not yet know if any personal data has been compromised.
Waltham Forest Council said on May 16 that it has been made aware of a possible breach, but does not currently know whether personal data has been compromised.
Camden Council in London has also reportedly been affected by the attack but is unaware of whether personal data has been accessed.
The impacted councils have warned their residents to be vigilant for social engineering attacks, showing extra cautious about unsolicited emails, text messages, phone calls and home visits.
Genuine callers will always be happy to present their ID badges.
East Lothian is also recommending service users consider regularly changing their key safe number, if they have one.
William Wright, CEO of Closed Door Security, said that the delay between the attack taking place and customers being warned potentially means residents across the UK have had their data lying in the hands of a dangerous ransomware group for many weeks.
The incident is another reminder of the risk posed to organizations by sharing confidential data with third party suppliers.
This incident is a reminder to understand the data your suppliers hold and how secure each supplier is.
This shouldn't only be done when contracts are signed, but continually, based on their risk profile, to ensure their defences are keeping pace with modern attack trends.
On May 14, banking giant Santander confirmed that customer and employee data was breached following a compromise of a third-party provider.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Fri, 17 May 2024 13:45:17 +0000