SOC status:Duty analyst on shift
Sectors · Healthcare
NHS trusts, integrated care systems, private providers, diagnostics and the suppliers they depend on. We monitor without disrupting clinical work, test without touching patient-facing systems in hours, and report in a form the board and the DSPT both accept.
NHS DSPTNIS RegulationsCyber Assessment FrameworkMHRAHealth-ISAC intelligence
The Synnovis incident of June 2024 — seven London hospitals, thousands of postponed appointments — remains the reference case for what a supplier compromise does to care. Ransomware operators such as Qilin, INC Ransom and SAFEPAY continue to target providers and the diagnostics, pharmacy and software suppliers around them, usually arriving through a VPN or edge-appliance vulnerability, bought credentials or a phishing email that impersonates the NHS itself. Underneath sits a legacy estate: clinical systems, virtualised infrastructure and biomedical devices that cannot be patched on a vendor's timetable. Our weekly healthcare report follows the operators, the vulnerabilities and the sector's own advisories, and says what to do first.
What we watch for
Pathology, pharmacy, EPR and SaaS suppliers as the route to many providers at once.
Remote-access defects exploited before the change window, then used to reach the hypervisor tier.
Biomedical and imaging devices on unsupported operating systems, segmented and watched rather than patched.
Domains and templates that mimic trust mail, referral and payroll systems.
ESXi-aware encryption of the virtualised estate that hosts clinical and administrative systems.
Patient and staff records taken from file-transfer and document platforms without encryption.
How we help
Weekly report
Healthcare's week is defined by Boston Scientific's global network outage, the McKesson disclosure of roughly 284 million patient-related records exfiltrated via third-party applications, and Medusa ransomware passing 500 victims.
The healthcare vertical continues to be shaped by the Synnovis retrospective (7 London hospitals, June 2024, Qilin, still generating disruption two years on) and by the sustained 10x surge in IPS events across UK hospitals reported by SonicWall for Jan-May 2026 (264k events).
The healthcare vertical is in a sustained reconnaissance phase from the perspective of the attackers. SonicWall's mid-year data - 264,000 IPS events across UK hospital networks Jan-May 2026 versus 27,000 across the whole of 2025, a 10x surge - is the anchor statistic for the reporting period.
Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659 (SharePoint deserialisation RCE), continued long-tail impact of the Synnovis / Qilin June 2024 attack on NHS South East London, and sustained ransomware activity by Qilin against healthcare-adjacent targets.
The dominant collection theme this period is continued aftermath reporting from the June 2026 London hospital ransomware incident, edge-appliance exposure introduced by the 23 June Ubiquiti UniFi OS KEV addition (operationally significant for hospital estates with widespread UniFi deployment)…
During the reporting period the principal observations were the continuing strategic consequence of the June 2024 Synnovis / NHS London pathology compromise - South London and Maudsley NHS Foundation Trust pathology systems remained partially un-restored into early 2026…
Questions
No. SOC365 reads telemetry; it does not install into medical devices or take automated action on clinical infrastructure. Containment on anything patient-facing is pre-agreed and confirmed with a named contact.
Cyber Essentials Plus and a readiness review against the DSPT expectations your NHS customers will ask about, then continuous monitoring of the systems that connect to theirs.
Yes. The evidence — logs, incident records, testing, response times, supplier assurance — is produced as a by-product of the services rather than as a separate paperwork exercise.
Start a conversation
A thirty-minute conversation about your estate, your suppliers and what an outage would actually stop.