NHS research data on 1.1 million patients accessed in University of Manchester hack

The University of Manchester disclosed on June 9, 2023 that an unauthorized party had accessed its systems and copied data. Later reporting established that the material included an NHS research dataset holding records on about 1.1 million patients drawn from roughly 200 hospitals.

The dataset had been built up from 2012 onward for medical research and covered major trauma cases, including people treated after terror attacks. The patient fields involved were narrow: NHS numbers and the first three letters of postcodes. Because the records had been gathered for research rather than through direct contact, many of the people involved would not have known the university held their information.

The Independent first reported the NHS element of the breach. Around 250 gigabytes of data was accessed overall, and the university confirmed that backup servers had been reached. Student and alumni records were also copied, including names, contact details, dates of birth, university identification numbers and fee status. The attackers emailed students directly in an attempt to increase pressure on the institution.

The university notified the Information Commissioner's Office, the National Cyber Security Centre and the National Crime Agency, suspended off-campus VPN access as a precaution and closed access to the affected dataset. The University of Manchester warned NHS leaders that there was potential for NHS data to be made available in the public domain. The incident was not connected to the concurrent MOVEit campaign, and the investigation remained open as of early July 2023.