Archive — US — techcrunch
NHS vendor Advanced to pay £3M fine following 2022 ransomware attack
NHS vendor Advanced will pay over £3M in fines for failing to implement basic security measures before a ransomware attack in 2022. The UK's data protection regulator, ICO, stated that Advanced violated data protection laws, leading to a significant breach affecting NHS operations and patient data.
Key points
- Advanced, an NHS vendor, was fined £3M after a ransomware attack in 2022.
- The Information Commissioner's Office (ICO) originally sought a £6M fine for security lapses.
- Advanced failed to implement multi-factor authentication, enabling hackers to steal credentials.
- The LockBit ransomware attack disrupted NHS services and compromised personal data.
- The ICO's ruling is a significant enforcement of data protection laws in the healthcare sector.
Why it matters
- This incident highlights the ongoing vulnerabilities in healthcare IT systems, emphasizing the importance of cybersecurity measures.
- In 2025, IT trends show increased focus on cybersecurity, especially in critical sectors like healthcare.
- Similar ransomware attacks in recent years demonstrate a rising pattern of cyber threats against organizations lacking robust security protocols.
The case serves as a critical reminder of the need for enhanced cybersecurity in healthcare, as Advanced's penalties reflect a growing trend of strict enforcement of data protection regulations.