UK NHS ambulance organizations struggle after cyber-attack on health software vendor Ortivus

Several UK NHS ambulance organizations face challenges in recording patient data and sharing it with other healthcare providers due to a recent cyber-attack targeting Sweden-headquartered health software vendor Ortivus.

According to Ortivus, the cyber attack occurred on July 18 and affected UK customer systems within its hosted data center environment. The MobiMed ePR (electronic patient records) system, designed to facilitate monitoring and record-keeping in pre-hospital care and share vital parameters with other care providers, was the primary target of the attack.

Two major ambulance services, the South Western Ambulance Service Trust and the South Central Ambulance Service Trust, had moved to a hosted environment for Ortivus’s MobiMed software as part of an agreement signed in 2020. Together, they serve a population of approximately 12 million people.

Insiders close to the incident revealed that the South Central Ambulance Service Trust had resorted to pen and paper due to the cyber-attack, and staff members were being cautioned about potential phishing attacks. The efforts to patch servers believed to be running on Microsoft Windows Server were reportedly ongoing.

Ortivus stated that the electronic patient records were currently unavailable and being handled manually until further notice. The company assured that no patients had been directly affected, and the attack did not extend to other systems or customers outside the hosted data center.

On July 21, Ortivus announced its readiness to relaunch MobiMed ePR for hosted environment customers, pending approval by NHS authorities before the ambulance trusts could reconnect. However, the company’s CEO, Reidar Gårdebäck, couldn’t provide a definite timeline for the completion of the third-party forensic analysis.

Gårdebäck confirmed that the alternative system was prepared within 24 hours of the attack. Although a backup system was available for viewing patient records, the cyber-attack impacted integrations with other systems, leading to operational disruptions. While neither NHS England nor the vendor denied the impact on these trusts, they refrained from providing further details about the extent of the effects.