Security services are investigating a major cyber attack on the NHS 111 system that has left patients struggling to get urgent appointments and ambulance call-outs.
NHS 111 staff across the country have been forced to use pens and paper after a crucial system was shut down by hackers feared to be linked to a hostile state.
The public have been told to expect delays when calling the hotline, as NHS sources warned the disruption could drive patients to overstretched accident and emergency departments over the weekend. Officials believe the outage will last until Tuesday at the earliest.
Hackers targeted Advanced, a firm which supplies software to 85 per cent of NHS 111 services. The firm's Adastra system allows call handlers to dispatch ambulances, book out of hours urgent appointments, and fulfil emergency prescriptions.
More than 1,000 care homes, which use the firm’s Caresys software, have also been affected - along with mental health services across the NHS, which use its record management system.
An NHS source said: "At the moment, call-handling and response times are holding up but there is a concern that that situation may change over the weekend, and that we could see a deterioration.
"Cases in need of an ambulance are being prioritised."
NHS 111 call handlers have been told to use an alternative system to send ambulances, the source added.
The National Cyber Security Centre said that it is working with Advanced to investigate the cause.
Cyber attacks 'used by adversarial states'
It comes after the Five Eyes international intelligence alliance - consisting of Britain, Australia, Canada, New Zealand and the United States - warned of the risk of state-sponsored cyber attacks coordinated from Moscow following the UK’s response to Russia’s invasion of Ukraine, targeting critical organisations including the NHS, nuclear power stations and parts of the Civil Service.
There was said to be intelligence suggesting hackers within the Russian government were seeking to engage in "malicious cyber activity" in response to the "unprecedented economic sanctions" imposed on Moscow. All NHS trusts were warned in March to shore up their cyber security systems and ensure they had back-ups in place.
Bob Seely, a Conservative MP on the House of Commons foreign affairs committee, said: "It is undoubtedly true that cyber warfare is one of the tools of modern hybrid, full-spectrum conflict.
"It is used by adversarial states, including Russia, and other states like China.
"This attack could be criminal gangs acting with the tacit support of the Russian state or it could be the Russian state itself.
"Considering that we are one of the major supporters of Ukraine, if it is the Russians it's not exactly going to be unexpected."
The outage has left NHS 111 staff "working on paper" and is "negatively affecting" response times, according to a letter from NHS bosses sent to London GPs.
The letter sent to GPs, seen by Pulse, said call handlers have been left unable to book patients directly for appointments and family doctors have been asked to "manage calls where possible".
Direct booking for call handlers into other services was shut down and staff have been told to try and make them via the phone or emails instead.
The Welsh Ambulance Service said the "major outage" had impacted all four nations and it could take longer for 111 calls to be answered over the weekend.
Plans are in place due to a system outage impacting 111 and GP out-of-hour services across Wales.
The public can still call 111 but your call may take longer than usual to be answered.
If it's not urgent, head to https://t.co/EDEUp8Z93Y
Read more here: https://t.co/O3kjVk1dqv pic.twitter.com/KEzYWcFxH1
— Welsh Ambulance (@WelshAmbulance) August 5, 2022
Pharmacy sources said the outage would also impact patients calling NHS 111 for emergency out of hours prescriptions. Pharmacists have been told to check NHS emails for email referrals, or they may receive phone calls from NHS 111 staff directly.
Other systems owned by Advanced that have been affected include Caresys - a care home management software which is used by more than 1,000 homes across the UK.
A patient record management system, Carenotes, which is used by more than 40,000 clinicians predominately in mental health services, has also been shut down.
Simon Short, the chief operating officer of Advanced, said a "security issue" was first identified on Thursday.
"We can confirm that the incident is related to a cyber attack and as a precaution, we immediately isolated all our health and care environments," he said.
"This occurred at approximately 7am on August 4. We can also confirm that this action contained the attack and no further issues have been detected."
The British software firm has more than 25,000 customers and a turnover of £330 million, according to its website. It has officers in Birmingham, Ashford, Kent, Atlanta in the US, Bangalore in India and Melbourne in Australia. This latest attack will raise fears that hackers could target private companies who partner with critical organisations in the UK, such as the NHS.
'Contingency plans are in place'
In 2017, parts of the NHS were crippled by a cyber attack from hackers in North Korea. Hospitals, pharmacies and GP surgeries were hit, with some hospitals forced to cancel treatment and operations.
In May, Russian hackers from the criminal group Killnet said they attacked vital NHS ventilator networks, after one of their gang was arrested in the UK.
Health officials have been keen to encourage patients to continue to call 111 for non-urgent health issues, amid fears A&E units could be inundated if patients instead turn to them for help.
The Society for Acute Medicine warned that the NHS is running at "unsustainable levels", with long delays in emergency departments, staff shortages and a lack of beds.
Dr Nick Scriven, past president of the society, said: "This is the first time in my memory things have been so hard at this time of the year."
On Friday, Isle of Wight NHS Trust declared a critical incident in response to "sustained pressure" on its services. The trust said its A&E was "full" and encouraged patients to visit NHS 111 online for advice if feeling unwell.
🚨 Due to extreme pressure on our services we have declared a critical incident.
Please visit NHS 111 online first https://t.co/XBHQ1XfnC0 and only call 999 if you have a serious or life-threatening condition or injury.
Read more in our news story ▶️ https://t.co/89tSssMQpM pic.twitter.com/KZqwsLTnid
— Isle of Wight NHS Trust (@IOWNHS) August 5, 2022
An NHS spokesman said 111 services are still available to patients but urged people to call 999 in an emergency.
"There is currently minimal disruption and the NHS will continue to monitor the situation as it works with Advanced to resolve their software system as quickly as possible," said the spokesman. "Tried and tested contingency plans are in place for local areas who use this service."