NHS Dumfries and Galloway remains ‘vigilant’ over cyber attacks

A Scottish health board has said it remains “vigilant” for potential cyber attacks nearly a year after a major data breach.

Hackers managed to access a huge amount of NHS Dumfries and Galloway information – including confidential details on patients and staff – in February 2024.

The health board said it was “in no way complacent” about its data security nearly 12 months later and staff were now required to undertake a mandatory programme of cyber-security and information governance training on an annual basis.

Police Scotland said its inquiries into the attack were ongoing.

The health board was targeted in February last year and details of the incident started to emerge the following month.

It is one of the most serious cyber attacks ever seen to date in Scotland.

The health board said it had mounted a “robust and rigorous response, supported by respected third party specialists – offering a high degree of assurance”.

“However, the ever-evolving threat of cyber security is always present, and NHS Dumfries and Galloway is working along with its supporting partners to remain vigilant and ensure that we are taking all reasonable and appropriate mitigations,” said a statement.

It declined to reveal any information it had on how access to its system had been gained, saying that could “potentially invite fresh attempts” on not just its own IT defences but those of other organisations.

However, it did confirm that no member of staff had been disciplined in connection with the attack.

In total, more than 100 people phoned a dedicated helpline which was established after the incident and advice is still hosted “prominently” on the NHS Dumfries and Galloway website.

The health board said it also now worked closely with staff to try to avoid any repeat attack.