Loading story…
NHS Forth Valley is investigating a data protection incident after a staff member emailed a spreadsheet containing sensitive maternity patient information to a personal email account. The breach affected about 150 women who used local maternity services, and the exposed data reportedly included names, dates of birth, NHS numbers, pregnancy treatment details, and, for some patients, the total number of children.
The Scottish health trust said there is no evidence the information was shared more widely and that the staff member reported deleting the email. NHS Forth Valley has notified affected patients and reported the incident to the UK Information Commissioner’s Office and Police Scotland while an internal investigation continues.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Following the disclosure, NHS Forth Valley said it was investigating the incident, notified affected individuals, and reported the matter to the UK Information Commissioner's Office and Police Scotland. The trust also said there was no evidence of wider sharing and that the staff member reported deleting the email.
NHS Forth Valley disclosed that a staff member emailed a spreadsheet containing maternity patient data to their personal email account, affecting about 150 women. The exposed information reportedly included names, dates of birth, NHS numbers, pregnancy treatment details, and number of children for some patients.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nottingham University Hospitals NHS Trust apologized after a public inquiry found survivors of the 2023 Nottingham attacks were not properly included when the trust investigated unauthorized access to their medical records. The inquiry said staff inappropriately viewed victims’ records without authorization, and a 2025 internal investigation uncovered broader misuse of sensitive patient information. The trust said its response initially focused too narrowly on bereaved families, while disciplinary action resulted in 11 employees being dismissed and several others receiving written warnings for serious data protection violations. Separately, the fallout from the 2024 Synnovis ransomware attack linked to the **Qilin** gang continues to widen across the NHS, with Mid and South Essex NHS Foundation Trust confirming about **2,380** specialist diagnostic testing records were affected after Bedfordshire Hospitals NHS Foundation Trust disclosed nearly **33,000** impacted records. The attack disrupted pathology services across south east London, causing canceled appointments, delayed operations, and blood testing and transfusion problems, while stolen patient data was later published online after extortion failed. NHS organizations are still identifying affected patients, and King’s College Hospital NHS Foundation Trust has said service delays caused by the outage contributed to a patient’s death.
Jun 29, 2026
NHS Dumfries and Galloway disclosed a cyberattack that raised the risk of patient data exposure, and weeks later stolen records linked to the incident were published online as part of an extortion campaign. Reporting indicated that highly sensitive files involving children’s health information were among the leaked material, escalating the impact from service disruption to a serious confidentiality breach affecting vulnerable patients. The incident fits a broader pattern of ransomware and extortion operations targeting healthcare providers, where attackers disrupt clinical systems and use stolen data to pressure victims. Similar attacks previously hit New Zealand’s Waikato District Health Board, where a ransomware intrusion crippled hospital IT, forced lengthy restoration from backups across hundreds of servers and thousands of workstations, and underscored that healthcare organizations remain high-value targets because outages and data theft can directly affect patient care.
Jun 29, 2026
Scotland's Crown Office and Procurator Fiscal Service (**COPFS**) said a cyber incident at an unnamed third-party supplier may have exposed personal information belonging to about 300 staff members. The compromised data was linked to an online government data maturity assessment and included employee names, roles, and work email addresses. COPFS said its own systems were not breached and that the incident did not affect operations or expose sensitive casework, victim, witness, or other confidential prosecution data. The supplier detected suspicious activity on **August 5** and launched an investigation, while COPFS said the full scope of the breach remains under review. Reporting indicates the impact could extend beyond COPFS because multiple Scottish government bodies may have participated in the same assessment program. The supplier has reportedly taken steps to secure its systems, but the intrusion method has not been confirmed; one report noted a possible, unverified link to recent exploitation of a **Metabase** cloud-service zero-day.
Aug 15, 2026