NHS Cybersecurity – 20 Years of Warnings Ignored – At Our Peril
From 2000 to 2008, Andy Jenkinson was embedded in the £12 billion NHS National Programme for IT (NPfIT), the largest tech project in Europe at the time. Despite its ambition, it lacked a foundational pillar: Real Cybersecurity. Two decades later, the situation has not improved — and the consequences are now being felt on a national scale.
Recent analysis and incident reports confirm what many of us in the industry have warned for years: the NHS remains woefully exposed to cybercrime. The personal health data of millions of Britons hangs by a thread, and we’re sleepwalking into a systemic data collapse that is entirely preventable.
Perpetually Exposed, Perpetually Ignored
Much of the NHS’s digital infrastructure, including patient records and diagnostic data, is stored via outsourced US-based cloud providers — often without sufficient controls or visibility. These platforms, despite high costs and prestigious branding, are not immune to breaches. In fact, many have long histories of them.
Yet they continue to be awarded government contracts worth billions.
This isn’t simply oversight; it’s institutionalised complacency.
We’re outsourcing the guardianship of our most sensitive health records to third parties who, in many cases, have previously failed to protect data. Meanwhile, NHS procurement, contract, and legal teams rarely demand minimum security standards, or mandate accountability. In doing so, they perpetuate a system that trades national data sovereignty for short-term convenience.
An Avalanche of Attacks — and a Culture of Silence
New research suggests the NHS has suffered over 75,000 cyberattacks since the year 2000 — roughly 360 attacks per week, or 51 a day. And those are just the known cases. Most remain unreported, under-investigated, or quietly swept aside to preserve reputational damage.
The average healthcare-related cyberattack costs around £100,000, meaning the cumulative financial toll may now exceed £7.5 billion. That figure does not reflect the real human cost: delayed procedures, cancelled operations, and a creeping erosion of public trust in the security of their most intimate data.
Consider the high-profile ransomware attack on Synnovis in June 2024. Services across King’s College Hospital, Guy’s and St Thomas’, and other London NHS Trusts were paralysed. Over 10,000 outpatient appointments and nearly 1,700 elective procedures had to be cancelled. Emergency patients were diverted, and a critical shortage of O-type blood was declared — an indirect, but potentially lethal, impact.
Qilin, the ransomware group behind the attack, later published nearly 400GB of stolen data, including patient names, NHS numbers, and sensitive blood test information.
And yet, this is just the tip of the iceberg.
