Tech provider for NHS England confirms data breach

DXS International, a technology supplier for the National Health Service (NHS) in England, has reported a cyberattack that affected its office servers. The breach was uncovered on December 14, as confirmed in a statement released by the company on Thursday. Following the incident, DXS took prompt action by collaborating with NHS officials and engaging a cybersecurity firm to assess the situation thoroughly. In their filing with the London Stock Exchange, DXS assured stakeholders that the impact on their services was minimal, and crucially, front-line clinical services remained operational. While the specifics of the breach have yet to be disclosed, the company is investigating whether any patients’ medical data was compromised. Adding to the situation, a ransomware group known as DevMan has claimed responsibility for the attack, asserting they stole 300 gigabytes of information from DXS. This claim was made on their dark web site, as reported by TechCrunch. In response to the breach, DXS has notified law enforcement and the Information Commissioner’s Office (ICO), the U.K.'s data protection authority. NHS England spokesperson Katie Baldwin stated that there is currently no evidence suggesting that patient services have been affected. However, DXS and ICO representatives have not yet provided comments on the ongoing investigation. DXS emphasizes on their website that their software is designed to optimize costs for healthcare providers, indicating that it interacts with patient records and may utilize the NHS’ Health and Social Care Network (HSCN) for data management. Notably, the NHS does not maintain a centralized repository for patient medical files.