NHS (press update)
incransomThis record tracks a ransomware attack claimed by the incransom group against NHS (press update). It collects the publicly disclosed attack details — sector, location and timeline — as published on the operator's leak site and indexed by Breach House.
Window Zero
EXPOSURE GAPWindow Zero is the time the breach stayed in the open before anyone said so — the gap between when the attack was first discovered on the operator's leak site (t1) and when it was publicly disclosed (t2). The wider this window, the longer victims, staff and customers were exposed with no warning.
Attack Summary
After the first post on our blog, we contacted the NHS administration for a month by phone and email urging them to negotiate. In response, we received laughter and statements that they didn't care if we published. Moreover, we contacted the cyber police and received rudeness from these law enforcement officers. And now they're trying to present it like this: Julie White, chief executive of NHS Dumfries and Galloway, said: “This is an utterly abhorrent criminal act by cyber criminals who had threatened to release more data”.
Leak Screenshots
SAMPLEProof-of-breach screenshots the operator posted from the stolen data. Previews are redacted and locked — the originals are available on HaveIBeenRansom.