Building an NHS fit for the future: how can the health service protect itself from cyber threats?

The NHS, as the UK’s largest employer and an essential national service, is a prime target.

In 2022 alone, there were over 1,400 reported cyber incidents across the NHS network – many involving phishing attacks and malware.

The 2017 WannaCry ransomware attack demonstrated just how vulnerable critical infrastructure can be, causing mass disruption and costing the NHS £92 million.

Cybercriminals are constantly adapting. With the use of social engineering and AI-driven attacks, traditional defences like spam filters and antivirus software are no longer enough in the UK healthcare sector.

Healthcare data is incredibly valuable on the dark web, making NHS systems an attractive target.

One example is the £3 million fine imposed by the Information Commissioner’s Office (ICO) on a healthcare IT supplier, following a major 2022 breach.

The cyber attack compromised sensitive patient data from nearly 80,000 people and disrupted access to electronic health records across multiple NHS trusts.

Alarmingly, it also exposed details on how to enter the homes of 890 patients receiving domiciliary care.

Cyber threats are often viewed through the lens of data loss. But, as Professor Ciaran Martin, former head of the National Cyber Security Centre, recently warned, the most damaging breaches do more than access sensitive patient data – they disrupt care.

As well as data breaches, critical networked medical devices could also be compromised.

Calling the outdated NHS IT infrastructure a “national security issue,” he argued that the healthcare sector is uniquely vulnerable: it’s the one sector where cyber attacks can directly harm people.

For instance, when ransomware hit a pathology provider in 2023, over 16,000 appointments and operations were cancelled.

The NHS later linked the attack to two cases of “severe” patient harm and 11 cases of “moderate” harm. The financial fallout was equally severe, with the provider reporting a £32.7 million in direct losses, including £5.6 million in staffing costs and £6.3 million to rebuild IT systems.

Broader disruption across South East London’s integrated care network brought the total to £35.7 million – excluding reputational damage to NHS trusts reliant on international patients.

But the deeper issue isn’t just the cost or consequences – it’s whether the NHS is prepared for the scale of the threat.

A recent board report revealed that 190 cyber attacks on NHS organisations were reported to the ICO in 2024 alone – a 54% year-on-year increase.

Cybersecurity in the healthcare industry starts with a solid foundation. That means having a well-defined risk framework, supported by effective tools and systems.

At Radar Healthcare, our quality and compliance management system is a central hub for incident reporting and risk tracking, helping organisations stay compliant and respond quickly.

A key component of successful cyber resilience is a clear cyber response plan. Knowing what to do when something goes wrong – who to contact, what actions to take, how to contain the threat – can make all the difference in limiting the impact of an incident.

This plan must be practical, accessible, and rehearsed.

It’s this human vulnerability that often creates the entry point for attackers, which is why a strong focus on staff training is so important and aims to play a huge role in prevention.

Phishing simulations, for example, are one of the most effective ways to build awareness among healthcare professionals.

By mimicking real-world scams and offering feedback and educational content, these simulations help NHS staff develop the instincts to spot suspicious activity.

When paired with regular communication, video training and real-world examples, training becomes part of the organisational culture.

We also ensure that all staff complete annual training tasks, along with regular refreshers to check compliance and reinforce cybersecurity best practices across the organisation.

Clear policies, responsibilities and procedures – such as password guidelines, multi factor authentication, email account standards and acceptable use policies – ensure that everyone knows what’s expected of them.

Cybersecurity isn’t just about technology; it’s about behaviour. Every day staff need a direct link to clear, understandable guidance and advice to make safe choices online, keep vital health systems secure and healthcare services running smoothly.

While prevention is crucial, resilience means being ready to respond. A well-prepared organisation will have an incident response plan in place that can be activated immediately when an attack is detected.

At Radar Healthcare, when an incident is logged through our compliance system, me, our security engineer and our IT support partner are notified immediately.

Depending on the nature of the threat – whether it’s a phishing email or an actual data breach -predefined procedures are launched.

This might involve removing harmful emails from all inboxes, isolating affected systems, or initiating communication protocols with relevant authorities, as well as notifying our internal team.

Response planning and research must also consider worst-case scenarios, including data breaches involving sensitive patient information.

Organisations need to be clear on who to notify, how to report incidents, and what legal or regulatory obligations must be fulfilled. Cybersecurity isn’t just about stopping attacks – it’s about recovering swiftly and minimising harm when they occur.

If you are unable to have an IT team, an effective IT partner can not only support day-to-day operations but also help organisations navigate emergencies with confidence.

Choosing the right partner requires diligence, expertise, and an understanding of healthcare-specific needs.

Ongoing assessments of cybersecurity readiness are essential. Regular security audits allow organisations to identify vulnerabilities before they can be exploited.

These audits should include system checks, policy reviews, software patching schedules, and penetration testing.

Internal audits can be conducted by trained staff, while more complex testing – like penetration testing – may require third-party specialists.

Testing should examine both internal and external systems, ensuring that the entire IT ecosystem is protected.

At Radar Healthcare, we conduct audits to assess data security across the organisation.

At Radar Healthcare, we have a dedicated team accountable for managing these checks and acting on the findings – but everyone within the team is responsible for being aware and vigilant.

It’s crucial for all healthcare organisations to do the same – being proactive is just as important as being reactive.