NHS England’s Cyber Security Operations Centre (CSOC) reported 147 ransomware or serious cyber incidents affecting NHS trusts and integrated care boards in 2025. The figure — a 34% increase on the 110 incidents recorded in 2024 — was published in a quarterly security bulletin distributed to NHS cyber leads but not proactively released to the public. Exposed News obtained the data through a Freedom of Information request.
What “Serious Incident” Means
NHS England’s cyber incident classification system defines a “serious incident” (Category 1 or 2) as an event that causes or risks causing significant disruption to patient care, data loss affecting 1,000 or more records, or a successful ransomware deployment. The 147 figure includes confirmed ransomware deployments, significant data exfiltration events, and successful intrusions that were contained before causing wider damage.
It does not include lower-tier incidents — phishing campaigns, unsuccessful intrusion attempts, or malware infections that were isolated to non-clinical systems. The CSOC estimates it records approximately 4,000 lower-tier incidents annually across the NHS estate. These are not publicly reported individually.
The Pattern of Incidents
Analysis of the 147 incidents by trust type shows that acute trusts (major hospitals) accounted for 41% of serious incidents, mental health trusts for 19%, community health trusts for 16%, and integrated care boards and commissioning bodies for the remaining 24%. The concentration in acute trusts reflects their size and complexity, but also their dependency on legacy clinical systems that are difficult to patch without disrupting patient care.
Geographically, the incidents were not evenly distributed. Three integrated care systems — which Exposed News is not identifying while FOI appeals regarding further detail are pending — accounted for 28% of all serious incidents. All three had previously been flagged in NHS Digital (now NHS England) cyber maturity assessments as having below-average resilience scores. Investment to address those assessments had been approved but not fully deployed by the time the incidents occurred.
The Legacy System Problem
A recurring factor in serious NHS cyber incidents is the presence of systems running software that is no longer supported by the manufacturer — “end of life” software for which security patches are no longer issued. NHS Digital’s 2024 annual cyber review estimated that approximately 40% of NHS clinical systems were running software components that had reached or exceeded end of life. The figure has fallen from 52% in 2019, but the rate of improvement has slowed.
End-of-life systems cannot be patched against newly discovered vulnerabilities. Ransomware groups specifically target known vulnerabilities in end-of-life software, running automated scans for exposed systems. The NHS’s exposure to this class of attack is a function of procurement decisions made over decades, in which the clinical risk of updating systems was weighed against the financial cost of replacement — and replacement was deferred.
Funding and Staffing
NHS England’s published cyber security budget for 2024/25 was £338 million, including capital and revenue spending across all trusts. Independent analysis by the Health Foundation, published in June 2025, estimated that the NHS would need to spend approximately £1.1 billion annually on cyber security to reach the resilience standard recommended by the government’s own cyber security strategy. The gap between current and required spending is approximately £760 million per year.
Staffing is a parallel challenge. NHS cyber security teams are competing for talent with the private sector, where equivalent roles pay significantly more. Vacancy rates in NHS cyber security roles averaged 23% across responding trusts in the NHS Staff Survey 2025 — higher than any other specialist workforce category.
The Patient Impact
Ransomware incidents have direct patient care consequences. The most significant UK healthcare cyber incident — the 2024 attack on Synnovis, a pathology services provider — resulted in more than 10,000 NHS appointments being cancelled or postponed over several weeks. Blood transfusion services were affected. The National Crime Agency attributed the attack to a Russian-linked ransomware group.
For the 147 incidents recorded in 2025, NHS England has not published aggregate data on patient care disruption. Responses to individual FOI requests submitted by health journalists indicate that collectively the incidents resulted in thousands of appointment cancellations and delays to diagnostic results. NHS England told Exposed News: “Cyber security is a priority for the NHS and we are investing in improving resilience across the estate. We take every incident seriously and work to minimise the impact on patient care.”