NHS 111 suffers major cyber attack as staff resort to ‘pens and paper’

·6-min read
Advanced’s Adastra software is used by 85 per cent of NHS 111 services and impacts 40 million patients
Advanced’s Adastra software is used by 85 per cent of NHS 111 services and impacts 40 million patients

Security services are investigating a major cyber attack on the NHS 111 system that has left patients struggling to get urgent appointments and ambulance call-outs.

NHS 111 staff across the country have been forced to use pens and paper after a crucial system was shut down by hackers feared to be linked to a hostile state.

The public have been told to expect delays when calling the hotline, as NHS sources warned the disruption could drive patients to overstretched accident and emergency departments over the weekend. Officials believe the outage will last until Tuesday at the earliest.

Hackers targeted Advanced, a firm which supplies software to 85 per cent of NHS 111 services. The firm's Adastra system allows call handlers to dispatch ambulances, book out of hours urgent appointments, and fulfil emergency prescriptions.

More than 1,000 care homes, which use the firm’s Caresys software, have also been affected - along with mental health services across the NHS, which use its record management system.

An NHS source said: "At the moment, call-handling and response times are holding up but there is a concern that that situation may change over the weekend, and that we could see a deterioration.

"Cases in need of an ambulance are being prioritised."

NHS 111 call handlers have been told to use an alternative system to send ambulances, the source added.

The National Cyber Security Centre said that it is working with Advanced to investigate the cause.

Cyber attacks 'used by adversarial states'

It comes after the Five Eyes international intelligence alliance - consisting of Britain, Australia, Canada, New Zealand and the United States - warned of the risk of state-sponsored cyber attacks coordinated from Moscow following the UK’s response to Russia’s invasion of Ukraine, targeting critical organisations including the NHS, nuclear power stations and parts of the Civil Service.

There was said to be intelligence suggesting hackers within the Russian government were seeking to engage in "malicious cyber activity" in response to the "unprecedented economic sanctions" imposed on Moscow. All NHS trusts were warned in March to shore up their cyber security systems and ensure they had back-ups in place.

Bob Seely, a Conservative MP on the House of Commons foreign affairs committee, said: "It is undoubtedly true that cyber warfare is one of the tools of modern hybrid, full-spectrum conflict.

"It is used by adversarial states, including Russia, and other states like China.

"This attack could be criminal gangs acting with the tacit support of the Russian state or it could be the Russian state itself.

"Considering that we are one of the major supporters of Ukraine, if it is the Russians it's not exactly going to be unexpected."

The outage has left NHS 111 staff "working on paper" and is "negatively affecting" response times, according to a letter from NHS bosses sent to London GPs.

The letter sent to GPs, seen by Pulse, said call handlers have been left unable to book patients directly for appointments and family doctors have been asked to "manage calls where possible".

Direct booking for call handlers into other services was shut down and staff have been told to try and make them via the phone or emails instead.

The Welsh Ambulance Service said the "major outage" had impacted all four nations and it could take longer for 111 calls to be answered over the weekend.

Pharmacy sources said the outage would also impact patients calling NHS 111 for emergency out of hours prescriptions. Pharmacists have been told to check NHS emails for email referrals, or they may receive phone calls from NHS 111 staff directly.

Other systems owned by Advanced that have been affected include Caresys - a care home management software which is used by more than 1,000 homes across the UK.

A patient record management system, Carenotes, which is used by more than 40,000 clinicians predominately in mental health services, has also been shut down.

Simon Short, the chief operating officer of Advanced, said a "security issue" was first identified on Thursday.

"We can confirm that the incident is related to a cyber attack and as a precaution, we immediately isolated all our health and care environments," he said.

"This occurred at approximately 7am on August 4. We can also confirm that this action contained the attack and no further issues have been detected."

The British software firm has more than 25,000 customers and a turnover of £330 million, according to its website. It has officers in Birmingham, Ashford, Kent, Atlanta in the US, Bangalore in India and Melbourne in Australia. This latest attack will raise fears that hackers could target private companies who partner with critical organisations in the UK, such as the NHS.

'Contingency plans are in place'

In 2017, parts of the NHS were crippled by a cyber attack from hackers in North Korea. Hospitals, pharmacies and GP surgeries were hit, with some hospitals forced to cancel treatment and operations.

In May, Russian hackers from the criminal group Killnet said they attacked vital NHS ventilator networks, after one of their gang was arrested in the UK.

Health officials have been keen to encourage patients to continue to call 111 for non-urgent health issues, amid fears A&E units could be inundated if patients instead turn to them for help.

The Society for Acute Medicine warned that the NHS is running at "unsustainable levels", with long delays in emergency departments, staff shortages and a lack of beds.

Dr Nick Scriven, past president of the society, said: "This is the first time in my memory things have been so hard at this time of the year."

On Friday, Isle of Wight NHS Trust declared a critical incident in response to "sustained pressure" on its services. The trust said its A&E was "full" and encouraged patients to visit NHS 111 online for advice if feeling unwell.

An NHS spokesman said 111 services are still available to patients but urged people to call 999 in an emergency.

"There is currently minimal disruption and the NHS will continue to monitor the situation as it works with Advanced to resolve their software system as quickly as possible," said the spokesman. "Tried and tested contingency plans are in place for local areas who use this service."

Our goal is to create a safe and engaging place for users to connect over interests and passions. In order to improve our community experience, we are temporarily suspending article commenting