UK health services call-handling vendor faces $7.7M fine over 2022 ransomware attack

The ICO has provisionally fined Advanced Computer Software Group £6.09M for security failings that led to a LockBit-attributed ransomware attack in August 2022 which forced NHS services to revert to pen-and-paper operations. Attackers used legitimate credentials to access a Citrix server (no MFA), moved laterally, escalated privileges, deployed encryption malware, and exfiltrated personal and medical data for 82,946 people—including sensitive information and access details for vulnerable individuals—causing significant operational disruption to NHS 111 services.