The Target: Synnovis, a pathology services provider for the National Health Service (NHS) in the U.K.
The Take: The leaked data includes patient names, dates of birth, NHS numbers, and descriptions of blood tests, as reported by the BBC. The extent of the data breach and whether test results are included remains unclear.
The Vector: Synnovis was hit by the ransomware attack earlier this month, creating disruptions at major London hospitals. The leak saw almost 400GB of private information published on the darknet.
This breach is critical reminder that zero-day exploits do happen, and furthermore that patching software in a timely, effective manner is a key component of ensuring customer data is protected. Ensuring third-party vendors are deploying patches and fixes in accordance with a firm’s cybersecurity policy is an important step in an overall robust security posture.