Home / Health / NHS Trust Reveals Massive Data Breach Two Years Later
NHS Trust Reveals Massive Data Breach Two Years Later
2 Jun
Summary
- Nearly 33,000 patients' data stolen and shared online.
- Attack occurred on a supplier in June 2024, revealed two years later.
- Data may include names, dates of birth, and test results.
In a significant data security incident, Bedfordshire Hospitals NHS Foundation Trust has revealed that personal information of approximately 32,927 patients was compromised and subsequently published online. This breach stemmed from a major ransomware cyber-attack on a crucial supplier that serves healthcare bodies, which took place in June 2024. It has taken more than a year for the supplier to analyze the highly unstructured and fragmented data.
The trust, which manages acute hospitals in Bedford and Luton and Dunstable, learned in October 2025 that data relevant to its patients had been affected. The compromised information could potentially include patient names, dates of birth, patient numbers, NHS numbers, postcodes, and test results. While the data was shared on online forums, the trust stated that there is currently no evidence of it being accessed or used inappropriately.
Following a thorough review and consultation with NHS England's information governance team, the trust notified the Information Commissioner's Office. Measures are being taken, including a court injunction against third parties, to prevent further dissemination of the stolen data.
