NHS Dumfries and Galloway has released a draft letter warning locals to assume that some of their data was compromised in the recent cyber-attack facing the health board.

In February this year, the NHS health board of Dumfries and Galloway was the victim of a cyber-attack. While services were not interrupted, cyber-criminals were able to access large amounts of personal patient and staff data, which were published on the internet on May 6 after their ransom demands were not met.

Now, the health board is alerting all residents of Dumfries and Galloway that “the best approach to take is to assume that some data relating to you is likely to have been copied and published.”

Residents are advised to take the situation seriously, and be cautious around any attempts to access their computer systems, or of any approaches by anyone claiming to hold their data.

The letter provided some detail on what type of data was stolen – mainly small files such as x-rays or test results, correspondence between health teams, and correspondence between health teams and patients.

As the volume of stolen data was so large, analysing the data and contacting affected individuals proved a challenge to the board, so they are prioritising what they deem to be ‘high-risk’ cases of more vulnerable patients. Those deemed ‘high-risk’ will be contacted by the board if it is revealed that their data was compromised and published in the attack.

The letter warned that threat actors could use the stolen information to exploit victims further, but cautioned that any attempt to do so would be against the Data Protection Act.

Both NHS staff and the wider public have been asked to be on guard toward any suspicious activity.

“This includes any attempts to access computer systems, such as suspicious emails from an unverified sender asking them to click a link (known as ‘phishing’), as well as phone calls,” the letter read.

Recommended reading

• NHS Dumfries and Galloway Stolen Data Published on Dark Web
• NHS Scotland Confirms Data Theft
• NHS Dumfries and Galloway Hit by Cyber-attack

The NHS board also recognised that the cyber-attack, and the ongoing revelations detailing is expansive impact, can lead to anxiety for potentially affected individuals in the community.

The board therefore included a helpline that can provide support, including phycological support for affected individuals experience anxiety.

“On behalf of NHS Dumfries and Galloway, I would like to apologise for the anxiety which may have been caused to you due to this situation,” Julie White, chief executive of NHS Dumfries and Galloway said in the letter. “We have sought to be as open as possible while adhering to the very explicit guidance we have received from Police Scotland and partner agencies”