Summary
The UK data watchdog is set to fine NHS vendor Advanced for security failures that occurred before the LockBit ransomware attack. These security lapses contributed to the vulnerability exploited during the attack.
The cyber attack had extensive repercussions, impacting the systems for dispatching ambulances, booking out-of-hours appointments, and issuing emergency prescriptions.
In a provisional ruling, the ICO stated that the software provider violated data protection laws by failing to secure personal information for 82,946 individuals.
These records were stolen in a ransomware attack by hackers who accessed Advanced's computer systems through an account that lacked multi-factor authentication (MFA).
Typically, MFA would have prevented cyber criminals from using stolen passwords to gain access.
The stolen data included sensitive information such as phone numbers, medical records, and details on how to access the properties of 890 people receiving home care.
FAQs
Our frequently questions
Find out how iliomad can help your company.
Only visible in production
MR-001 CNIL: what clinical trial sponsors must know about French health data compliance
Understand MR-001 CNIL obligations for clinical trial sponsors in France, from Article 32 security requirements to breach notification and cross-border data transfers.
ICF Boilerplate and Open-Access Database Disclosures: What Clinical Trial Sponsors Must Know
Learn how US site ICF boilerplate on commercial products and open-access genetic databases affects sponsor data governance, Common Rule compliance and GDPR obligations.
iliomad Weekly Digest: DPO Conflicts, Bulk Data Rules, Healthcare Cyber Incidents and AI Transparency
This week: CNIL on DPO conflicts of interest, DOJ bulk data rule for life sciences, wave of healthcare ransomware attacks, Uber's €825m GDPR fine and AI disclosure demands.
