Ransomware halts test reporting at South Africa's National Health Laboratory Service

The National Health Laboratory Service, which provides diagnostic pathology for roughly 80 percent of South Africa's population across more than 250 laboratories, was struck by ransomware in the early hours of 22 June 2024. Parts of its infrastructure were encrypted and the organisation shut down IT systems, including email, its website and the laboratory information system that returns results to clinicians.

Sections of the NHLS environment were deleted, including on its backup server, meaning damaged components had to be rebuilt rather than simply restored. Laboratories stayed open and continued processing clinical samples, but automated report generation and the web portal doctors use to retrieve results were unavailable. Urgent results were relayed to requesting clinicians by telephone.

The effects were felt across public health facilities nationally. By early July, Techpoint Africa reported a backlog of more than 6.3 million unprocessed tests, with operations postponed and intensive care units affected. The disruption arrived while the country was monitoring an mpox outbreak.

The NHLS said a preliminary investigation found that no patient information had been compromised and that all patient data was safe. It activated an incident response team of internal specialists and external cybersecurity experts, added further security layers and deliberately kept some systems offline for repair. It gave no restoration timeline at first, saying only that rebuilding would take time, and later indicated that recovering the affected data would take several weeks.