Children's mental health data published after cyber attack

NHS Dumfries and Galloway has confirmed some children’s mental health data has been published by criminals following a cyber attack.

A ransomware group targeted the health board earlier this year and has now published a large volume of patient data on an area of the internet called the dark web.

The health board’s chief executive Julie White said the hack was unprecedented and she apologised to patients and staff.

She said the number of people affected was still unknown but could be thousands.

Ms White described the data release as an "utterly abhorrent criminal act".

She said work was now beginning with other national agencies including the Scottish government, police and National Cyber Security Centre to assess what has been published.

Ms White told BBC News that some children’s mental health data had been published as a result of the hack.

"This could affect hundreds if not thousands of patients and staff across Dumfries and Galloway," she added.

"At this point in time we are unable to give an exact figure.

"It is unlikely that it would affect every patient in Dumfries and Galloway but could affect significant quantities.

"What we’re fairly confident in at the moment is that the hackers were unable to access entire patient medical records."

Rebecca Richardson said she had not heard from the health board

Rebecca Richardson, 51, of Stranraer said she was "very concerned" about what information the hackers might have got.

"We’ve not heard anything directly from the NHS and it raises my concerns and I know other people will be worried," she said.

"Dumfries and Galloway have an elderly population who struggle with using online services, and this will reaffirm to them that online isn’t safe and can be manipulated.

“But it’s nigh on impossible to get a GP appointment so I’m not surprised we’ve heard so little, as they are not well resourced, and the buck stops with the government on sorting this out."

Joe Lynch is also concerned about the data breach

Joe Lynch, 65, of the Rhins of Galloway, said: “I’ve been aware of this issue for a few weeks since it was first made public.

“It seemed to me of real concern but to me it’s been played down by the public sector.

"So far the NHS have pretended that there is nothing to see here, and play it down, but it’s like horses and stable doors.

"It’s clear what’s happened and that there’s a problem and we need some openness and transparency about what’s been stolen, how and what’s being done to resolve the problem."

Julie White said it was "unlikely" every patient in the region would be affected

South of Scotland MSP Colin Smyth described the release of data as a "worrying development".

The Labour MSP told the BBC's Good Morning Scotland programme: "There is no doubt it will cause a great deal of anxiety for patients and staff of NHS Dumfries and Galloway."

He added hackers had been able to access "a very substantial amount of data", including contact details for both staff and patients.

Mr Smyth said: "It is important the NHS try to do what they did when the initial data was released - that is contact the individuals affected.

"But if they can't do that because the data is so substantial it is very important the NHS make that clear at an early stage, and at the very least contact the most vulnerable people whose data may have been released onto the dark web."

A Police Scotland spokesman said: "Police Scotland inquiries are continuing into a cyber attack on NHS Dumfries and Galloway."

A Scottish government spokesperson said: "The Scottish government is aware of a further publication of data on the internet, linked to the recent cyber attack on NHS Dumfries and Galloway.

"It is important to note that the incident remains contained to NHS Dumfries and Galloway and there have been no further incidents across NHS Scotland as a whole.

"The Scottish government is working with the health board, Police Scotland and other agencies including the National Crime Agency and National Cyber Security Centre to assess the level of this breach and the possible implications for individuals concerned.

"The Scottish government is continuing to provide support to NHS Dumfries and Galloway as they deal with this ongoing situation. This remains an on-going police investigation."

Phone helpline

A dedicated telephone helpline is now open to the public from 09:00 until 18:00 Monday to Friday and 09:00 until 13:00 on Saturdays.

The health board urged the public to be alert for any attempts to access their work and personal data, or for approaches by anyone claiming to be in possession of either their personal data or NHS data - whether this approach comes by email, telephone, social media or some other means.

In all instances, people are advised to take down details about the approach and contact Police Scotland online.

Information is being regularly updated on the website www.nhsdg.co.uk/cyberattack