NHS England’s technology provider confirms the data breach

DXS International, a UK-based company that provides healthcare technology to England’s National Health Service (NHS), disclosed the cyberattack in a statement on Thursday.

In filing On the London Stock Exchange, the company said that it had been subjected to a “security incident affecting its office servers,” which was discovered on December 14. The company said it “immediately” contained the breach in cooperation with the NHS, and hired a cybersecurity firm to investigate “the nature and extent of the incident”.

“There has been minimal impact on the company’s services and the company’s frontline clinical services remain unaffected and operational,” the filing said.

At this stage, the specific nature of the breach is not known, nor whether any patient’s medical information was stolen.

However, earlier this week, a ransomware group called DevMan claimed responsibility for the hack. In a post on its dark web site, which was seen by TechCrunch, hackers listed the company on December 14 and claimed to have stolen 300 gigabytes of data from the company.

DXS said it had also notified law enforcement and regulators, including the UK’s Data Protection Authority, the Information Commissioner’s Office, or ICO, about the cyberattack.

NHS England spokesperson Katie Baldwin told TechCrunch that the health service is “not aware of any patient services being affected.”

Representatives for DXS and ICO did not immediately respond to a series of questions sent by TechCrunch.

attic WebsiteDXS says it provides software that helps reduce costs for physicians and primary care physicians. As such, the company’s software addresses patient records and data. The company also says that in some cases, its solutions are hosted on the NHS health and social care network (HSCN), a dedicated system for healthcare organizations across the UK to access and share information.

In general, the NHS does not store a patient’s medical data in a central system.