Moorfields Eye Hospital Dubai ransomware attack

In August 2021, the AvosLocker ransomware group attacked the Dubai branch of Moorfields Eye Hospital, the internationally branded outpost of the UK's renowned NHS-affiliated Moorfields Eye Hospital. The gang claimed to have stolen roughly 60 GB of patient and staff data and, when its demands were not met, published it online in a classic double-extortion operation.

What happened

AvosLocker listed the victim on its dark-web leak site on 15 August 2021 as "Moorfields NHS UK & Dubai," implying a breach of the London parent organisation. In reality, only the Dubai hospital's systems were affected — there was no evidence that UK NHS servers were touched. Moorfields confirmed the "IT security incident" on 16 August, stating it impacted its Dubai operations and that affected patients were being notified.

True to the double-extortion model, AvosLocker both encrypted systems and exfiltrated data. When the hospital did not pay, the gang dumped a first batch of stolen files and, on 1 September 2021, released the remainder of the trove.

Impact

• Approximately 60 GB of internal data was exfiltrated.
• The stolen files reportedly included copies of patient ID cards, insurance claims, financial documents, hospital call logs and internal messages — highly sensitive healthcare and identity data.
• Because the data concerned an eye hospital's patients, it carried both medical-privacy and identity-fraud risks for affected individuals in the UAE.
• Moorfields notified affected Dubai patients and engaged in incident response and remediation; no ransom payment was confirmed.

Attribution

The attack was claimed by AvosLocker, a ransomware-as-a-service operation that emerged in mid-2021 and targeted critical-infrastructure and healthcare organisations worldwide. AvosLocker was later the subject of a 2022 FBI/FinCEN advisory warning that it had attacked entities across multiple U.S. critical-infrastructure sectors. The Moorfields Dubai operation was among its early high-profile healthcare hits.

Why it matters

The Moorfields Dubai breach highlighted the exposure of internationally branded healthcare providers operating in the Gulf, where a globally recognised name can attract attackers seeking maximum leverage and publicity. It illustrated how double-extortion ransomware turns patient data into a coercion tool, and reinforced the need for segregated, well-defended overseas branch networks even when the parent organisation's home systems remain untouched.