Loading story…
DXS International, a key technology supplier to the UK's National Health Service (NHS), experienced a cyberattack that targeted its internal office servers. The incident was detected and contained by DXS's IT staff in collaboration with NHS England, and a third-party digital forensics firm has been engaged to investigate the scope and nature of the breach. DXS reported the incident to the London Stock Exchange and notified relevant authorities, including the Information Commissioner's Office. The company stated that its clinical services and frontline operations remained unaffected, and there is currently no confirmation that NHS patient data was compromised.
DXS International provides widely used clinical decision support and referral management tools, supporting millions of NHS patients and a significant portion of GP referrals in England. While the company is not a core electronic health record provider, some of its systems process patient data to assist healthcare providers. The ongoing investigation aims to determine the full impact of the breach, and DXS has assured stakeholders that the incident is not expected to have a material adverse effect on its finances. The event highlights the growing risks faced by health technology suppliers and the potential implications for healthcare delivery, even when core patient records are not directly affected.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
DXS publicly disclosed the cyber incident in a stock exchange filing, said it was working with NHS cybersecurity teams and external forensic specialists, and notified authorities including the Information Commissioner's Office. The company said there was no confirmed impact on patient care and no confirmation that NHS patient data was compromised.
On December 15, 2025, a threat actor identified as Devman2 claimed responsibility for the DXS intrusion and alleged it stole 300 GB of data. The claim was reported without public proof.
DXS International said unauthorized access to its internal office servers occurred on December 14, 2025, affecting a technology supplier used across the NHS. The company said the incident was quickly contained and that frontline clinical services were not disrupted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcego.theregister.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Healthdaq, a Dublin-based recruitment platform used by Northern Ireland health trusts and other public health bodies, disclosed unauthorized access to its systems after attackers linked to the **XP95** extortion group claimed to have stolen nearly half a million files. Reported exposed data includes names, contact details, CVs, qualifications, passport copies, other government-issued identification, criminal background checks, vaccine records, forms, and in some cases health information. Healthdaq said it detected the breach on 30 March, contained the incident, and notified regulators and law enforcement, including the Garda National Cyber Crime Bureau, while the UK Information Commissioner's Office said it is assessing the company’s report. The incident prompted heightened alerts across Northern Ireland health trusts because of the volume and sensitivity of the compromised records and the risk of identity theft, fraud, and misuse of personal information. Reporting indicates Healthdaq received a ransom demand, and threat intelligence describes XP95 as a newly observed actor using a **pure data theft and extortion** model rather than file-encrypting ransomware; its first publicly identified victim was Eholo Health, a Spanish mental health SaaS provider serving psychologists in Spain and Andorra. The breach also underscored broader pressure on healthcare technology suppliers after a separate attack on Dutch EPD vendor ChipSoft disrupted hospital services and triggered parliamentary scrutiny over sector dependence on a small number of critical vendors.
Jun 29, 2026
Bedfordshire Hospitals NHS Foundation Trust said data relating to **32,927 patients** was identified in material stolen during the **Synnovis ransomware attack**, confirming that the incident extended beyond service disruption into a significant patient data breach. The compromised information was linked to pathology-related files dating from **2011 to 2020** and may include personal details and diagnostic test results. The trust issued a public notification tied to the Synnovis cyber incident and began informing affected individuals after determining that their records were present in data later published on dark web sites. The organizations involved said notification was delayed because the stolen material was fragmented across unstructured administrative pathology files, requiring lengthy forensic analysis to attribute ownership and assess impact. Security experts said the case highlights the long-tail risk of third-party attacks in NHS supply chains, warning that even partial or disjointed healthcare records can be combined by threat actors for phishing, fraud, and other identity-related abuse.
Jun 29, 2026
NHS Dumfries and Galloway disclosed a cyberattack that raised the risk of patient data exposure, and weeks later stolen records linked to the incident were published online as part of an extortion campaign. Reporting indicated that highly sensitive files involving children’s health information were among the leaked material, escalating the impact from service disruption to a serious confidentiality breach affecting vulnerable patients. The incident fits a broader pattern of ransomware and extortion operations targeting healthcare providers, where attackers disrupt clinical systems and use stolen data to pressure victims. Similar attacks previously hit New Zealand’s Waikato District Health Board, where a ransomware intrusion crippled hospital IT, forced lengthy restoration from backups across hundreds of servers and thousands of workstations, and underscored that healthcare organizations remain high-value targets because outages and data theft can directly affect patient care.
Jun 29, 2026