NHS Cybercrime: Why Healthcare Is Britain's Most Targeted Sector
147 ransomware incidents were recorded across NHS organisations in 2025 — a 34% year-on-year increase. We examine the structural vulnerabilities that make Britain's health service the primary target for criminal and state-sponsored threat actors.
Why the NHS Is Targeted
The National Health Service is the UK's largest employer and one of the world's largest healthcare organisations, holding sensitive personal and medical data on virtually the entire UK population. Its scale, the age of many of its IT systems, and the operational necessity of maintaining near-continuous access to patient records make it uniquely vulnerable to ransomware attacks.
The NHS is not a single organisation. It comprises hundreds of trusts, clinical commissioning groups, integrated care boards, and associated bodies, each with their own IT infrastructure and security posture. This fragmentation means that security standards vary significantly between organisations, and that a vulnerability in one trust's systems does not automatically trigger protective action elsewhere.
The 2017 WannaCry attack — which infected 80 NHS organisations and forced the cancellation of approximately 19,000 appointments — demonstrated both the vulnerability of NHS IT infrastructure and the cascading operational consequences of a successful attack. Despite subsequent investment in NHS cyber resilience, incident data shows that attack frequency and sophistication have continued to increase.
The 2025 Incident Data
FOI requests submitted to NHS England and individual NHS trusts reveal 147 ransomware incidents across NHS organisations in England in 2025 — a figure that represents a 34% increase on the 110 incidents recorded in 2024. Scotland, Wales and Northern Ireland report separately; the combined UK figure is estimated at approximately 190 incidents.
Of the 147 incidents, 31 were classified as "significant" by the NHS's Data Security and Protection Incident Management team, meaning they involved substantial operational disruption, large-scale data exposure, or both. Twelve required external assistance from the National Cyber Security Centre (NCSC).
The average time between initial compromise and detection was 194 days — meaning that in many cases, threat actors had persistent access to NHS systems for more than six months before the intrusion was identified. This dwell time is significantly longer than the 86-day average across all UK sectors reported in the NCSC's 2025 Annual Review.
Patient Data Exposure
An estimated 1.4 million patient records were exposed or exfiltrated in NHS-related incidents in 2025. This figure includes data stolen in ransomware attacks where a "double extortion" model was used — in which threat actors both encrypt systems and threaten to publish stolen data unless a ransom is paid.
Patient data exposed in NHS breaches is particularly sensitive because it includes not only names, addresses and NHS numbers, but frequently also diagnostic codes, treatment histories, medication records and mental health data. Under UK GDPR, such data constitutes a special category requiring enhanced protection.
The Information Commissioner's Office (ICO) issued regulatory action in relation to 14 NHS organisations in 2025, including monetary penalties totalling £3.2 million. Campaigners note that ICO penalties, while significant, are typically levied against NHS trusts — meaning the financial impact falls on NHS budgets rather than on individual officers responsible for security failures.
What the Government Is Doing
The Government published a new NHS Cyber Security Strategy in 2023, committing £338 million to improve NHS resilience by 2025. DHSC progress reports indicate that approximately £214 million of this had been deployed by the end of 2025, with the remainder subject to further review as part of the Spending Review.
The NCSC provides a range of free services to NHS organisations, including the Active Cyber Defence programme, which blocks known malicious domains and email attacks. NHS England's Data Security Centre coordinates incident response and maintains the CareCERT service for distributing threat intelligence to trusts.
Critics, including the Health and Social Care Select Committee, argue that the government's investment is insufficient relative to the scale of the threat, and that the fragmented structure of NHS IT governance makes coordinated defence fundamentally difficult. The committee's 2025 report recommended the creation of a single NHS CISO with authority across all NHS organisations — a recommendation that had not been implemented as of October 2026.
Frequently Asked Questions
In a ransomware attack, threat actors typically encrypt data on NHS systems, rendering it inaccessible to staff. In double-extortion attacks, they also copy data before encrypting it and threaten to publish it unless a ransom is paid. NHS England advises trusts not to pay ransoms. If data is exfiltrated, the trust must notify the Information Commissioner's Office within 72 hours under UK GDPR. Affected patients are notified where the breach is likely to result in a high risk to their rights and freedoms.
The NCSC recommends a range of baseline controls including network segmentation to limit the spread of infections, multi-factor authentication for all privileged access, regular offline backups that cannot be encrypted by ransomware, and patching programmes to address known vulnerabilities. The NHS's own Data Security and Protection Toolkit provides a self-assessment framework for trusts, though completion of the toolkit does not guarantee security.
The WannaCry ransomware attack of May 2017 exploited a vulnerability in older Windows operating systems. It spread rapidly through NHS networks because many trusts were still running Windows XP, which Microsoft had stopped supporting in 2014. The attack caused the cancellation of approximately 19,000 appointments, diverted ambulances, and cost the NHS an estimated £92 million in disruption and remediation. A 2018 NAO report found that the attack was "unsophisticated" and could have been prevented by basic security practices.
Cybersecurity responsibility within the NHS is distributed across multiple organisations. NHS England's Data Security Centre provides national-level guidance and incident coordination. Individual NHS trusts are responsible for their own security posture and must comply with the Data Security and Protection Toolkit. The NCSC provides national-level threat intelligence and response support. The ICO regulates data protection compliance and can levy financial penalties for breaches. No single body holds comprehensive authority over NHS-wide security standards.