Advanced / NHS 111 ransomware attack

On 4 August 2022, Advanced, a major software and hosting supplier to the UK's National Health Service, was hit by LockBit 3.0 ransomware in an attack that rippled across British healthcare and forced clinicians back to pen and paper.

What happened

The attackers gained entry through a customer account that lacked multi-factor authentication, then deployed LockBit 3.0. Advanced detected the intrusion on 4 August and immediately pulled part of its infrastructure offline to contain the spread.

That containment, while necessary, knocked out hosted clinical systems including Adastra — used by roughly 85% of NHS 111 services to triage urgent but non-emergency calls — along with Carenotes, Caretaker, Crosscare, Odyssey, and Staffplan. The disruption was severe enough that the UK government convened a COBR crisis meeting, fearing the impact on patient care as staff resorted to manual record-keeping.

Impact

• The NHS 111 triage service and multiple community and mental-health systems were disrupted for weeks while Advanced restored services.
• Attackers exfiltrated data before encryption. The ICO later confirmed that personal data — phone numbers and medical records — of 82,946 people was taken, including details of how to gain entry to the homes of 890 people receiving care at home.
• Advanced reported spending roughly £18.3 million on remediation, with further costs in the following financial year.

Regulatory action

In August 2024, the ICO announced its provisional intent to fine Advanced £6.09 million, finding the company had failed to implement appropriate measures — notably comprehensive multi-factor authentication and timely vulnerability scanning — before the attack. In March 2025, the ICO finalised a reduced penalty of £3.07 million, reflecting Advanced's cooperation and the voluntary settlement.

Why it matters

The Advanced incident is a defining UK example of healthcare supply-chain risk: a single hosting supplier's compromise cascaded into a national emergency-triage outage, demonstrating how concentrated dependence on one vendor can endanger patient safety. The absence of MFA on a single account as the entry point made it a recurring case study in NHS and ICO guidance on supplier security and basic access controls.