If you received care at a hospital managed by University College London Hospitals or University Hospital Southampton, your personal data could have been exposed.
Two of the UK’s leading NHS trusts – University College London Hospitals NHS Foundation Trust and University Hospital Southampton NHS Foundation Trust – have been named in connection with a serious cyberattack that may have compromised patient and staff data.
Here’s what cybersecurity experts have revealed so far:
- The breach was not a ransomware attack. Instead, attackers accessed systems covertly and extracted data by exploiting a software flaw
- The hackers exploited a vulnerability in Ivanti Endpoint Manager Mobile (EPMM), a software tool used to manage staff devices
- The software weakness was discovered on 15 May. It has now been fixed, but it is unclear whether systems previously exploited could still be vulnerable.
What information was accessed?
The exposed data reportedly includes:
- Staff phone numbers
- IMEI numbers (used to identify individual mobile devices)
- Authentication tokens (used to access internal systems).
While the full extent of the breach is still being assessed, experts warn that this type of access could also lead to unauthorised entry into other IT systems managed by the NHS – including potentially sensitive patient records and medical data.
One leading cybersecurity expert has described the breach as a “wake-up call for the healthcare system”. He has warned of the risk – not only to personal data – but across the NHS, potentially impacting critical hospital operations, appointments, surgeries, and systems and medical devices essential for patient care.
What can you do if you think you could be affected?
While the scale of the breach has not been confirmed, if you were treated at any of the hospitals managed by University College London Hospitals or University Hospital Southampton, your personal data could be compromised. This means you should be vigilant for signs of identity fraud, suspicious communications, or unusual activity related to your medical records.
Hospitals managed by these trusts include:
University College London Hospitals NHS Foundation Trust
- Elizabeth Garrett Anderson Wing
- Hospital for Tropical Diseases
- Institute of Sport, Exercise and Health
- National Hospital for Neurology and Neurosurgery
- Royal London Hospital for Integrated Medicine
- Royal National ENT and Eastman Dental Hospitals
- University College Hospital
- University College Hospital at Westmoreland Street
- University College Hospital Grafton Way Building
- University College Hospital Macmillan Cancer Centre
University Hospital Southampton NHS Foundation Trust
- Southampton General Hospital
- Princess Anne Hospital
- New Forest Birth Centre
- Royal South Hants Hospital
- Lymington New Forest Hospital
Could you be due compensation?
Patients have the right to hold organisations accountable when their sensitive information is mishandled. And, under UK data protection law, you may be entitled to compensation if your information was compromised due to inadequate security practices.
We have spoken to lawyers who are currently investigating a potential group legal action. If you think you might be able to join a claim, check your eligibility now.
