Under attack

Recent and developing situations

The NHS has been the subject of cyber attacks for some time, with several major incidents occurring in the past few years alone. An attack in 2017 lead to the cancellation of thousands of hospital appointments and surgeries, when 80 trusts, 600 primary care and NHS providers and almost 600 GP practices were reported to be impacted.[i] Fast forward to June 2024 and there was another significant ransomware attack on NHS pathology lab partner, Synnovis, cancelling an estimated 6,000 appointments in just five weeks.[ii] In addition to the disruption caused to services, these and other security breaches resulted in thousands of stolen patient records being published or made available for purchase online for others to exploit.[iii]

Moving away from healthcare, the cyber attacks on NATO and EU countries in the past couple of years appear to more political in nature, having targeted government, logistics, aerospace and IT sectors of countries allied to the Ukraine. The scale of this hacking and the potential implications are enormous, especially when the perpetrators are already associated with espionage and sabotage.

More recently, Transport for London (TfL) announced a cyber security incident in early September, though, at time of writing, the impact on users remained contained with only a few services down. The National Crime Agency and National Cyber Security Centre were involved with the on-going investigation.

Around the same time, Tewkesbury Borough Council also announced a significant data security incident, which forced several of their systems offline. Even schools are being targeted by ransomware incidents, with a secondary school in Kent forced to close for a week at the start of the 2024 September term.

These are just some examples of cyber incidents that have been reported and continue to unfold in the UK. While we can only speculate as to who is behind such attacks in many cases, it is does emphasise just how broad the target may be.

Implications for the dental practice

Dental practices hold a substantial amount of data about both patients and staff. As such, we are potential targets as well – indeed, practices around the globe have already experienced incidents. While I am no expert in the field, there are some fairly simple actions we should all take as principals to safeguard our businesses and our people from cyber exposure. The National Cyber Security Centre offers a 10-step guidance to cyber security that all small businesses should consult.[iv]

The first step is to confirm that you are compliant with the necessary GDPR and other regulations set by the Information Commissioner’s Office,[v] for example, by appointing a data protection officer in the practice. They will be responsible for overseeing your data protection protocols and action plans.

Next, check that all your software and anti-virus packages are up-to-date. Speak to your IT company to assess your current systems and optimise your data security. It is also important to regularly change your passwords and ensure that your data is being correctly and safely backed up so you retain access to the important stuff should your server be compromised.

Another important aspect is to train staff so they understand the role they play in protecting the practice and its data. Phishing emails accounted for 83% of cyber attacks on UK businesses in 2022 (with denial of service, malware and ransomware attacks responsible for a further 21%).[vi] This makes it vital that all members of staff are able to recognise dubious emails and know how to deal with them. A protocol should be in place for the team to report any suspicious activity, whether emails or websites, to help warn others of possible threats.

Staying safe

In today’s digitally-driven world, no business is immune to the threat of cyber attacks. The criminals behind hacking attempts are becoming increasingly savvy in how they disguise their virtual assaults, so it’s important that we take a more sophisticated approach to staying safe. Dental practices are certainly possible targets, and it is our responsibility to protect our patients’ and teams’ data in any way that we can.

For further information please call EndoCare on 020 7224 0999

Or visit www.endocare.co.uk

EndoCare, led by Dr Michael Sultan, is one of the UK’s most trusted Specialist Endodontist practices. Through the use of the latest technologies and techniques, the highly-trained team can offer exceptional standards of care – always putting the patient first. What’s more, EndoCare is a dependable referral centre, to which dentists from across the country send their patients for the best in specialist endodontic treatment.

[i] Acronis. The NHS cyber attack. February 2020. https://www.acronis.com/en-gb/blog/posts/nhs-cyber-attack/ [Accessed September 2024]

[ii] NHS England. Synnovis cyber incident. June 2024. https://www.england.nhs.uk/synnovis-cyber-incident/ [Accessed September 2024]

[iii] Cowan D. Cyber expert urges against ‘panic’ over NHS data leak. May 2024. https://www.bbc.co.uk/news/articles/clw08q19n9ro [Accessed September 2024]

[iv] 10 steps to cyber security. National Cyber Security Centre. https://www.ncsc.gov.uk/collection/10-steps [Accessed September 2024]

[v] Information Commissioner’s Office. Data protection officers. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/accountability-and-governance/data-protection-officers/ [Accessed September 2024]

[vi] Gov.uk. Cyber security breaches survey 2022. Department for Digital, Culture, Media & Sport. Official Statistics. July 2022. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2022/cyber-security-breaches-survey-2022#:~:text=39%25-,Attack%20type,-Of%20the%2039 [Accessed September 2024]