iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Two separate cyber incidents affected UK hospital trusts in late November 2024. Alder Hey Children’s NHS Foundation Trust reported that data purportedly taken from systems it shared with Liverpool Heart and Chest Hospital NHS Foundation Trust had appeared online, but said services were operating normally. Wirral University Teaching Hospital NHS Foundation Trust isolated some systems, switched affected areas to paper processes and postponed some planned procedures and appointments. Alder Hey said the incidents were not linked.
What happened at Alder Hey?
On 28 November 2024, Alder Hey said material had been published online and shared through social media that purportedly came from systems shared by Alder Hey and Liverpool Heart and Chest Hospital NHS Foundation Trust. The trust said it was working with partners to verify the material and assess its potential impact. It did not confirm the amount or nature of any data exposure in that statement. Alder Hey’s statement
SecurityWeek reported that the ransomware group Inc Ransom had listed Alder Hey on its leak site and claimed to have stolen patient records, donor reports and other information dated 2018–2024. Those details were the group’s claims; Alder Hey said it was verifying the material. SecurityWeek’s report
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAlder Hey said it was working with the National Crime Agency and partner organizations to secure systems and take further steps in line with law-enforcement advice and its statutory duties concerning patient data. It also said services were operating normally and patients should attend appointments as usual at the time of the statement.
#1 Best Overall
What happened at Wirral University Teaching Hospital?
Wirral University Teaching Hospital said it detected suspicious activity and isolated systems as a precaution. Some IT systems went offline, and affected areas reverted to paper-based business continuity processes. The trust described the event as a “targeted cyber security issue”; its statement did not identify malware or ransomware. SecurityWeek said no known ransomware group had claimed responsibility for the Wirral incident. Wirral University Teaching Hospital’s updated statement SecurityWeek’s report
The disruption affected some scheduled appointments and procedures. Wirral said some procedures were postponed for rescheduling, emergency treatment remained the priority, and waits for unplanned treatment could be longer than usual. Its guidance at the time was for patients to attend scheduled appointments unless the trust contacted them otherwise. That was contemporaneous advice, not a statement of current service arrangements.
How the incidents differed
| Issue | Alder Hey | Wirral University Teaching Hospital |
|---|---|---|
| What the trust reported | Data had appeared online that purportedly came from shared systems; the trust was verifying it. | Suspicious activity prompted precautionary system isolation; some IT systems went offline. |
| Operational effect stated at the time | Services operating normally; patients told to attend appointments as usual. | Some planned appointments and procedures were disrupted or postponed; affected areas used paper processes. |
| Attack type or attribution | Inc Ransom claimed data theft, as reported by SecurityWeek; the trust’s statement did not independently confirm that claim. | The trust did not name a malware or ransomware type; SecurityWeek reported no known ransomware group claim. |
| Patient-care response | Normal services, according to the trust’s statement. | Emergency care prioritized; postponed procedures to be rescheduled, according to the trust. |
Were the hospital incidents connected?
No. Alder Hey explicitly said: “This incident is not linked to the ongoing incident at Wirral University Teaching Hospitals.” The two reports should therefore be understood as separate incidents, not as a single coordinated attack.
What is known—and what remains unclear
The November 2024 statements establish different immediate effects: Alder Hey was addressing reports of published data while saying its services were normal; Wirral had taken some systems offline and postponed some planned care. The reviewed statements do not give an incident-wide count of exposed records or postponed procedures. They also do not establish Wirral’s attack type or the eventual recovery and investigation outcomes. The statements describe the situation at that time, not the trusts’ status on a later date.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
