NeuralStackThe LockBit ransomware group published 3.1 million patient records from a UK NHS trust on its leak site on July 25 2026. The data includes names addresses medical histories and NHS numbers. The group set a 45 million dollar ransom demand with a 72-hour deadline.
The trust confirmed the breach on July 26 and stated it had isolated affected systems within four hours of detection. No evidence of encryption was found indicating the attackers focused on data exfiltration.
The National Cyber Security Centre is assisting the trust and has warned other NHS organizations to review access controls. The trust serves 1.2 million patients across three counties.
LockBit has claimed responsibility for over 4,000 attacks since 2020 and remains the most active ransomware group despite law enforcement takedown attempts. The group recently updated its encryptor to evade Windows Defender.
UK health sector breaches have increased 67 percent in the past 12 months according to official statistics.
Why this matters
The incident highlights persistent vulnerabilities in legacy healthcare IT systems that store sensitive data without modern segmentation. Patient trust in digital health records could erode if similar leaks continue.
Regulators may accelerate mandatory zero-trust requirements for NHS suppliers following this event. Cybersecurity insurance premiums for healthcare providers are expected to rise sharply in the next quarter.
International law enforcement continues to target LockBit infrastructure but the group has proven resilient to prior disruptions.