Tech provider for NHS England confirms data breach

DXS International, a U.K.-based company that provides healthcare tech for England’s National Health Service (NHS), disclosed a cyberattack in a statement on Thursday.

In a filing with the London Stock Exchange, the company said it experienced a “a security incident affecting its office servers,” discovered on December 14. The company said it “immediately” contained the breach working together with the NHS, and hired a cybersecurity firm to investigate “the nature and extent of the incident.”

“There was minimal impact on the company’s services and the company’s front-line clinical services remain unaffected and operational,” read the filing.

At this point, the specific nature of the breach is not known, nor whether any patients’ medical information was stolen. 

However, earlier this week, a ransomware group called DevMan took credit for the breach. In a post on its dark web site, which TechCrunch has seen, the hackers listed the company on December 14 and claimed to have stolen 300 gigabytes of data from the company.

DXS said it also notified law enforcement and regulators, including the UK’s data protection authority, the Information Commissioner’s Office, or ICO, about the cyberattack.

NHS England spokesperson Katie Baldwin told TechCrunch that the health service is “not aware of any patient services being impacted.”

Representatives from DXS and the ICO did not immediately respond to a series of questions sent by TechCrunch. 

On its website, DXS says it provides software that helps to reduce costs for doctors and primary care physicians. As such, the company’s software touches patient records and data. The company also says that in some cases, its solutions are hosted on the NHS’ Health and Social Care Network (HSCN), which is a system for healthcare organizations across the U.K. to access and share information. 

Generally speaking, the NHS does not store patient’s medical data in a centralized system.