National Health Service — Cyber Attacks, Breaches & Threat Activity

Threat entity extracted from intelligence sources

Frequency
14
occurrences
First Seen
November 11, 2025
Last Seen
July 6, 2026

National Health Service is a organization tracked across 16 threat clusters and 14 intelligence report mentions on ThreatCluster. First observed November 11, 2025; most recent activity July 6, 2026.

Overview

The National Health Service (NHS) is the United Kingdom's publicly funded healthcare system and a major national infrastructure body responsible for delivering health services across the country. Its vast data footprint and critical service delivery make it a high-value target for cyber threats, with recent incidents linked to the Clop ransomware group and Oracle zero-day exploits, underscoring its prominence in cybersecurity risk and resilience planning.

Related Threat Clusters

  • Synnovis Reports Data Breach Following June 2024 Ransomware Attack

    Synnovis, a UK pathology services provider, has notified healthcare providers of a data breach stemming from a ransomware attack that occurred in June 2024. The breach resulted in the theft of patient data, and Synnovis…

    3 articles · Updated November 12, 2025
  • Major Cyber Breach: Russian Hackers Compromise UK Government Logins

    Russian hackers have infiltrated the email accounts of UK government officials and Foreign Office staff in a significant cyber breach, dubbed 'FortiBleed.' The attack exploited vulnerabilities in over 80,000 Fortinet…

    28 articles · Updated July 5, 2026
  • Global Cyber Resilience Amid Rising State-Linked Attacks

    As of May 2026, approximately 5.5 billion people rely on the internet for essential services, making them vulnerable to cyber threats. Historical incidents like the NotPetya and WannaCry attacks illustrate the cascading…

    2 articles · Updated May 4, 2026
  • Clop Gang Targets UK NHS with Oracle Zero-Day Exploit

    The Clop ransomware gang has claimed the UK National Health Service as one of its latest victims, exploiting vulnerabilities in Oracle's systems. The NHS confirmed its involvement in the ongoing data theft campaign,…

    2 articles · Updated November 13, 2025
  • Romanian Hospitals Forced to Use Paper After Major Cyberattack

    In February 2024, over 100 hospitals in Romania were targeted by a significant cyberattack that exploited vulnerabilities in the Hippocrates medical software, deploying ransomware known as BackMyData. The attack forced…

    6 articles · Updated June 23, 2026
  • Clop Ransomware Targets UK NHS Using Oracle Zero-Day Exploits

    The Clop ransomware gang has claimed the UK National Health Service (NHS) as one of its latest victims, leveraging exploits of Oracle's zero-day vulnerabilities. The NHS has confirmed its inclusion in the list of…

    2 articles · Updated November 13, 2025
  • Clop Ransomware Claims Breaches of Canon and Mazda

    The Clop ransomware gang has claimed responsibility for breaches affecting Canon and Mazda, as reported on November 20, 2025. The UK's National Health Service was also reportedly compromised, with sensitive patient data…

    4 articles · Updated November 24, 2025
  • NATO Allies Consider Cyberattacks on Hospitals as Acts of War

    Recent polling indicates that a significant majority of citizens in NATO countries view cyberattacks on critical infrastructure, such as hospitals, as acts of war. The POLITICO Poll surveyed public opinion in the United…

    3 articles · Updated February 22, 2026
  • UK NHS Hospital Seeks Court Help to Prevent Ransomware Data Leak

    A National Health Service hospital in the UK is requesting intervention from the U.K. High Court to prevent a potential data leak resulting from a ransomware attack. The hospital is taking legal action to safeguard…

    2 articles · Updated December 8, 2025
  • NHS Investigates Clop Cyberattack Claim

    The UK's National Health Service (NHS) is investigating a cyberattack claim by the Clop extortion gang. Clop added the NHS to its leak site on November 11, 2025, but has not yet published any data regarding the breach.…

    2 articles · Updated November 14, 2025

Recent Intelligence Reports

  • Russian hackers attacked British government officials—the accounts were sold for $60,000 — News.Liga · July 6, 2026
  • How 100 Romanian hospitals switched to pen and paper to defeat a national cyber — Kahawatungu · June 23, 2026
  • Why cyber resilience needs to be concrete, cooperative and collective — Weforum · May 4, 2026
  • Poll: Top NATO allies believe cyberattacks on hospitals are an act of war — Politico · February 21, 2026
  • UK Hospital Asks Court to Stymie Ransomware Data Leak — Govinfosecurity · December 8, 2025
  • UK Hospital Asks Court to Stymie Ransomware Data Leak — Bankinfosecurity · December 8, 2025
  • More organizations allegedly compromised by Clop ransomware gang — Scworld · November 24, 2025
  • 7-Zip: Attackers Inject Malicious Code — Heise.De · November 20, 2025

CVSS v3.1 Breakdown