The IT systems at Medway Community Healthcare remain non-operational after a suspected cyberattack.
On 2 December 2024, Medway disclosed that it had detected "suspicious activity" and disconnected its IT systems to "protect patient and staff data". An investigation into the incident is ongoing.
As of 17 December, Medway confirmed its systems are not yet fully functional but stated it is "working methodically and carefully to restore them".
An update published on 13 December expressed gratitude to patients for their understanding and commended staff for maintaining services during the disruption. Medway acknowledged delays and disruptions caused by the outage, reiterating its commitment to patient safety while undergoing a thorough investigation overseen by NHS England.
The statement clarified that no evidence of unauthorised access to patient data was found during the investigation. As a result, Medway has begun the cautious reconnection of priority systems. However, it noted that the restoration process would be gradual and limited initially. Patients requiring blood tests will continue using paper forms in the interim.
Wider Context of NHS Cyber Incidents
This incident follows a cyberattack on Alder Hey Children’s NHS Foundation Trust on 28 November 2024, which also affected Liverpool Heart and Chest Hospital and Royal Liverpool University Hospital. Additionally, Wirral University Teaching Hospital NHS Foundation Trust declared a major incident for "cyber security reasons" on 25 November 2024.
In an update on 4 December, Wirral reported that the incident had been downgraded to a business continuity issue, with efforts underway to reinstate its main clinical systems.
Call for Increased Vigilance
Richard Horne, the recently appointed head of the National Cyber Security Centre (NCSC), emphasised the importance of ongoing vigilance in a speech on 3 December. Highlighting the June 2024 ransomware attack on pathology provider Synnovis, Horne noted:
"In the past year, we have seen crippling attacks against institutions that have brought home the true price tag of cyber incidents. The attack against Synnovis showed us how dependent we are on technology for accessing our health services."
These incidents underscore the growing necessity for robust cybersecurity measures across healthcare organisations to safeguard critical services and sensitive data.
Sophos has issued hotfixes to address three security vulnerabilities in its firewall products that could allow remote code execution and privileged system access under certain conditions. Two of these vulnerabilities are classified as Critical. There is no evidence of exploitation in the wild at this time.
Details of Vulnerabilities
Sophos disclosed that CVE-2024-12727 affects 0.05% of devices, while CVE-2024-12728 impacts approximately 0.5%.
Affected Versions
The vulnerabilities affect Sophos Firewall versions 21.0 GA (21.0.0) and older. The following versions include fixes:
Verification of Hotfix Installation
Users are encouraged to verify that the hotfixes have been applied:
cat /conf/nest_hotfix_status
(Hotfix applied if the value is 320 or above).
system diagnostic show version-info
(Hotfix applied if the value is HF120424.1 or later).
Temporary Workarounds
Until the updates can be applied, Sophos advises the following measures:
This announcement comes shortly after the U.S. government unsealed charges against Guan Tianfeng, a Chinese national, accused of exploiting a zero-day vulnerability (CVE-2020-12271, CVSS score: 9.8) in Sophos firewalls. This attack reportedly compromised 81,000 devices globally.
Sophos firewall users are strongly advised to apply the necessary updates immediately to prevent potential exploitation and to follow recommended security practices for additional protection.
IBM has released an urgent security update for its Cognos Analytics software, addressing two critical vulnerabilities, CVE-2023-42017 and CVE-2024-51466, which could enable malicious file uploads and Expression Language (EL) injection attacks. Organisations are strongly advised to apply the updates immediately to safeguard sensitive data and system functionality.
CVE-2023-42017: Malicious File Upload Vulnerability
CVE-2024-51466: Expression Language Injection Vulnerability
Affected Versions
The following versions of IBM Cognos Analytics are vulnerable to both flaws:
Available Fixes
Recommendations
The discovery of CVE-2023-42017 and CVE-2024-51466 underscores the necessity of proactive cybersecurity measures. Organisations using IBM Cognos Analytics should prioritise these updates to prevent exploitation, mitigate risks, and ensure the continued protection of sensitive information.